Starfield Technologies, Inc.

Certificate Policy
andCertification Practice Statement(CP/CPS)

Version 2.5
November 12, 2009i

Starfield CP-CPS V2.5

Table of Contents
1

Introduction............................................................................................................................. 1
1.1
Overview......................................................................................................................... 1
1.2
Identification ................................................................................................................... 1
1.3
Community and Applicability......................................................................................... 1
1.3.1
Certification Authorities ......................................................................................... 1
1.3.2
Registration Authorities .......................................................................................... 2
1.3.3
End Entities ............................................................................................................. 3
1.3.4
Applicability............................................................................................................ 3
1.4
Contact Details................................................................................................................ 3
2 General Provisions .................................................................................................................. 3
2.1
Obligations ...................................................................................................................... 3
2.1.1
Starfield Governance and Policy Authority Committee Obligations...................... 3
2.1.2
Certification Authority Obligations ........................................................................ 4
2.1.3
Repository Obligations ........................................................................................... 4
2.1.4
Registration Authority Obligations......................................................................... 4
2.1.5
Subscriber Obligations............................................................................................ 4
2.1.6
Relying Party Obligations....................................................................................... 5
2.2
Liability........................................................................................................................... 5
2.2.1
Warranties and Limitations on Warranties ............................................................. 5
2.2.2
Disclaimer of Warranties ........................................................................................ 9
2.2.3
Subscriber Liability................................................................................................. 9
2.2.4
Other Exclusions ................................................................................................... 10
2.3
Financial Responsibility................................................................................................ 10
2.3.1
Indemnification by Subscribers and Relying Parties ............................................ 10
2.3.2
Fiduciary Relationships......................................................................................... 12
2.3.3
Administrative Processes ...................................................................................... 12
2.4Interpretation and Enforcement .................................................................................... 12
2.4.1
Governing Law ..................................................................................................... 12
2.4.2
Severability, Survival, Merger and Notice............................................................ 12
2.4.3
Dispute Resolution Procedures ............................................................................. 13
2.5
Fees ............................................................................................................................... 13
2.6
Publication and Repository ........................................................................................... 14
2.6.1
Publication of CA Information ............................................................................. 14
2.6.2
Frequency of Publication ...................................................................................... 14
2.6.3
Access Controls..................................................................................................... 14
2.6.4
Repositories........................................................................................................... 14
2.7
Compliance Audit ......................................................................................................... 14
2.7.1
Frequency of Entity Compliance Audit ................................................................ 14
2.7.2
Identity/Qualifications of Auditor......................................................................... 15
2.7.3
Auditor's Relationship to Audited Party ............................................................... 15
2.7.4
Topics Covered by Audit ...................................................................................... 15
2.7.5
Actions Taken as a Result of an Audit Deficiency ............................................... 15
2.7.6
Communication of Results.................................................................................... 15
2.8
Confidentiality .............................................................................................................. 15ii

Starfield CP-CPS V2.5

2.8.1
Types of Information to be Kept Confidential...................................................... 15
2.8.2
Types of Information not Considered Confidential .............................................. 16
2.8.3
Disclosure of Certificate Revocation Information ................................................ 16
2.8.4
Release to Law Enforcement Officials ................................................................. 16
2.8.5
Release as Part of Civil Discovery........................................................................ 16
2.8.6
Disclosure Upon Owner's Request........................................................................ 16
2.8.7
Other Information Release Circumstances ........................................................... 16
2.9Intellectual Property Rights .......................................................................................... 16
3 Identification and Authentication.......................................................................................... 18
3.1
Initial Registration......................................................................................................... 18
3.1.1
Types of Names .................................................................................................... 18
3.1.2
Need for Names to be Meaningful........................................................................ 18
3.1.3
Rules for Interpreting Various Name Forms......................................................... 18
3.1.4
Uniqueness of Names............................................................................................ 18
3.1.5
Name Claim Dispute Resolution Procedure ......................................................... 18
3.1.6
Recognition, Authentication and Role of Trademarks.......................................... 19
3.1.7
Method to Prove Possession of Private Key ......................................................... 19
3.1.8
Authentication of Organization Identity ............................................................... 19
3.1.9
Authentication of Individual Identity.................................................................... 19
3.1.10 Unified Communications Certificate Authentication ........................................... 19
3.1.11 Medium Assurance Authentication....................................................................... 19
3.1.12 Authentication of Organization Identity for Extended Validation Certificates .... 19
3.1.13 Code Signing Certificate Authentication .............................................................. 20
3.1.14 Custom Certificate Authentication........................................................................ 20
3.2
Routine Re-key ............................................................................................................. 20
3.3
Re-key After Revocation .............................................................................................. 20
3.4
Certificate Renewal....................................................................................................... 21
3.5
Revocation Request....................................................................................................... 21
3.6
Suspension Request....................................................................................................... 21
3.7
Request to Release Suspension ..................................................................................... 21
4 Operational Requirements..................................................................................................... 21
4.1
Certificate Application.................................................................................................. 21
4.2
Certificate Issuance ....................................................................................................... 21
4.3
Certificate Acceptance .................................................................................................. 21
4.4
Certificate Suspension and Revocation......................................................................... 22
4.4.1
Circumstances for Revocation .............................................................................. 22
4.4.2
Who Can Request Revocation .............................................................................. 22
4.4.3
Procedure for Revocation Request........................................................................ 22
4.4.4
Revocation Request Grace Period......................................................................... 22
4.4.5
Circumstances for Suspension .............................................................................. 22
4.4.6
Who Can Request Suspension .............................................................................. 23
4.4.7
Procedure for Suspension Request........................................................................ 23
4.4.8
Limits on Suspension Period................................................................................. 23
4.4.9
CRL Issuance Frequency ...................................................................................... 23
4.4.10 CRL Checking Requirements ............................................................................... 23
4.4.11 Online Revocation/Status Checking Availability ................................................. 23iii

Starfield CP-CPS V2.5

4.4.12 Online Revocation Checking Requirements ......................................................... 23
4.4.13
Other Forms of Revocation Advertisements Available ........................................ 23
4.4.14 Checking Requirements for Other Forms of Revocation Advertisements ........... 23
4.4.15 Special Requirements for Key Compromise......................................................... 23
4.5
Certificate Problem Reporting and Response ............................................................... 24
4.5.1
Reporting............................................................................................................... 24
4.5.2
Investigation.......................................................................................................... 24
4.5.3
Response ............................................................................................................... 24
4.6
Security Audit Procedures ............................................................................................ 24
4.6.1
Types of Events Recorded .................................................................................... 24
4.6.2
Required Data Elements........................................................................................ 25
4.6.3
Frequency of Processing Log................................................................................ 25
4.6.4
Retention Period for Audit Log ............................................................................ 25
4.6.5
Protection of Audit Log ........................................................................................ 25
4.6.6
Audit Log Backup Procedures .............................................................................. 25
4.6.7
Audit Collection System (Internal vs. External) ................................................... 25
4.6.8
Notification to Event-Causing Subject ................................................................. 26
4.6.9
Vulnerability Assessments.................................................................................... 26
4.7
Records Archival........................................................................................................... 26
4.7.1
Types of Event Recorded...................................................................................... 26
4.7.2
Retention Period for Archive ................................................................................ 26
4.7.3
Protection of Archive ............................................................................................ 26
4.7.4
Archive Backup Procedures.................................................................................. 26
4.7.5
Requirements for Time-Stamping of Records ...................................................... 26
4.7.6
Archive Collection System (Internal or External) ................................................ 26
4.7.7
Procedures to Obtain and Verify Archive Information......................................... 26
4.8
Key Changeover............................................................................................................ 26
4.9
Compromise and Disaster Recovery............................................................................. 27
4.10 CA Termination ............................................................................................................ 27
5 Physical, Procedural and Personnel Security Controls ......................................................... 27
5.1
Physical Controls .......................................................................................................... 27
5.1.1
Site Location and Construction............................................................................. 27
5.1.2
Physical Access..................................................................................................... 27
5.1.3
Power and Air Conditioning ................................................................................. 27
5.1.4
Water Exposures ................................................................................................... 28
5.1.5Fire Prevention and Protection.............................................................................. 28
5.1.6
Media Storage ....................................................................................................... 28
5.1.7
Offsite Backup ...................................................................................................... 28
5.1.8
Waste Disposal...................................................................................................... 28
5.2
Procedural Controls....................................................................................................... 28
5.2.1
Trusted Roles ........................................................................................................ 28
5.2.2
Number of Persons Required Per Task ................................................................. 28
5.2.3
Identification and Authentication for Each Role .................................................. 29
5.3
Personnel Controls ........................................................................................................ 29
5.3.1
Background, Qualifications, Experience, and Clearance Requirements .............. 29
5.3.2
Background Check Procedures ............................................................................. 29iv

Starfield CP-CPS V2.5

5.3.3Training Requirements.......................................................................................... 29
5.3.4
Retraining Frequency and Requirements .............................................................. 29
5.3.5
Job Rotation Frequency and Sequence ................................................................. 29
5.3.6
Sanctions for Unauthorized Actions ..................................................................... 30
5.3.7
Contracting Personnel Requirements.................................................................... 30
5.3.8
Documentation Supplied to Personnel.................................................................. 30
6 Technical Security Controls.................................................................................................. 30
6.1
Key Pair Generation...................................................................................................... 30
6.1.1
Key Pair Generation.............................................................................................. 30
6.1.2
Private Key Delivery to Entity.............................................................................. 30
6.1.3
Public Key Delivery to Certificate Issuer ............................................................. 30
6.1.4
CA Public Key Delivery to Users ......................................................................... 30
6.1.5
Key Sizes............................................................................................................... 31
6.1.6
Public Key Parameters Generation and Quality Checking ................................... 31
6.1.7
Hardware/Software Key Generation ..................................................................... 31
6.1.8
Key Usage Purposes.............................................................................................. 31
6.2
CA Private Key Protection............................................................................................ 31
6.2.1
Standards for Cryptographic Module.................................................................... 31
6.2.2
Private Key Multi-Person Control ........................................................................ 31
6.2.3
Private Key Escrow............................................................................................... 32
6.2.4
Private Key Backup and Archival......................................................................... 32
6.2.5
Private Key Entry into Cryptographic Module ..................................................... 32
6.2.6
Method of Activating Private Keys ...................................................................... 32
6.2.7
Method of Deactivating Private Key .................................................................... 32
6.2.8
Method of Destroying Private Key ....................................................................... 33
6.3
Other Aspects of Key Pair Management....................................................................... 33
6.3.1
Public Key Archival.............................................................................................. 33
6.3.2
Usage periods for the Public and Private Keys..................................................... 33
6.4
Activation Data ............................................................................................................. 33
6.5
Computer Security Controls.......................................................................................... 33
6.5.1
Specific Computer Security Technical Requirements .......................................... 33
6.5.2
Computer Security Rating..................................................................................... 34
6.6Life Cycle Technical Controls ...................................................................................... 34
6.6.1
System Development Controls.............................................................................. 34
6.6.2
Security Management Controls............................................................................. 34
6.6.3
Life Cycle Security Ratings .................................................................................. 34
6.7
Network Security Controls............................................................................................ 34
6.8
Cryptographic Module Engineering Controls............................................................... 34
7 Certificate and CRL Profiles................................................................................................. 34
7.1
Certificate Profiles ........................................................................................................ 34
7.1.1
Root CAs............................................................................................................... 34
7.1.2
Issuing CA............................................................................................................. 39
7.1.3
Bridge CA Certificates.......................................................................................... 42
7.1.4
End Entity SSL Certificates .................................................................................. 44
7.1.5
End Entity Code Signing Certificates ................................................................... 49
7.1.6
End Entity Custom Certificates............................................................................. 52v

Starfield CP-CPS V2.5

7.2
CRL Profiles ................................................................................................................. 55
7.2.1
Root CAs............................................................................................................... 55
7.2.2
Issuing CAs ........................................................................................................... 61
8 Specification Administration ................................................................................................ 64
8.1
Specification Change Procedures.................................................................................. 64
8.2
Publication and Notification Policies............................................................................ 64
8.3
CPS Approval Procedures............................................................................................. 64
9 Definitions............................................................................................................................. 64vi

Starfield CP-CPS V2.5

1

Introduction

Starfield Technologies is an innovator in the field of Internet foundation services, providing
advanced software and Internet solutions critical to the building of online presence and ecommerce.
The Starfield Public Key Infrastructure (“Starfield PKI”) has been established to provide avariety of digital certificate services.
1.1

Overview

This Certificate Policy and Certification Practice Statement (CP/CPS) describes the practices of
the Starfield PKI and applies to all Certification Authorities (CAs) within the Starfield PKI
hierarchy. This CP/CPS is applicable to all entities with relationships with the Starfield PKI,
including Policy Authorities (PAs), Certification Authorities (CAs), Registration Authorities(RAs), Subscribers, and Relying Parties.
1.2

Identification

This document is formally referred to as the “Starfield Certificate Policy and Certification
Practice Statement” (Starfield CP/CPS). Starfield CAs issue certificates in accordance with thepolicy and practice requirements of this document.
1.3

Community and Applicability

1.3.1 Certification Authorities
Starfield Certification Authorities (CAs) perform the following general functions:• Create and sign certificates• Distribute certificates to the appropriate Subscribers and Relying Parties• Revoke certificates• Distribute certificate status information in the form of Certificate Revocation Lists(CRLs) or other mechanisms• Provide a repository where certificates and certificate status information are stored andmade available (if applicable).
Within the Starfield PKI, there are two general types of CAs: Root and Issuing CAs. Currently,
the Starfield PKI hierarchy consists of the following CAs:
CA Type
ValiCert RootCA

1

CA NameValiCert Class 2
Policy Validation
Authority (alsoreferred to as the“Starfield RootCA”)1

Description of Function
Serves as the legacy “trust anchor” for the Starfield
PKI hierarchy.

Starfield acquired the ValiCert Class 2 Policy Validation Authority from ValiCert, Inc. in June 2003.
Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

1

Starfield CP-CPS V2.5

Starfield RootCAStarfield Class 2
Certification
Authority

Starfield Root
CA – G2

Go Daddy RootCAGo Daddy Root
CA – G2

Legacy IssuingCA
Starfield 2048-bit
Issuing CA
Go Daddy 2048bit Issuing CA
Starfield Services
Root CAStarfield Services
Root CA – G2

Serves as the “trust anchor” for the Starfield PKI
hierarchy for any certificates other than those soldunder the Go Daddy brand. Issues any new CAs fordifferent types of PKI services except those usedwith the Go Daddy brand. Serves as a trusted root
for time stamping certificates.
Starfield Root
Second Generation (G2) Starfield Root CA. Serves
Certificate Authority as the “trust anchor” for the future Starfield PKI– G2
hierarchy for any certificates other than those soldunder the Go Daddy brand. Issues any future CAs
for different types of PKI services except those usedwith the Go Daddy brand. Serves as a trusted root
for time stamping certificates.
Go Daddy Class 2
Serves as the “trust anchor” for the Starfield PKI
Certification
hierarchy for any certificates sold under the Go
Authority
Daddy brand. Issues any new CAs for different typesof PKI services sold under the Go Daddy brand.
Go Daddy Root
Second Generation (G2) Go Daddy Root CA. Serves
Certificate Authority as the “trust anchor” for the future Starfield PKI– G2
hierarchy for any certificates sold under the Go
Daddy brand. Issues any future CAs for different
types of PKI services sold under the Go Daddy
brand.
Starfield Secure
Issues SSL web server certificates to authenticatedCertification
organizations and individuals.
Authority
Starfield Class 2
Issues certificates to authenticated organizations andCertificationindividuals.
Authority
Go Daddy Class 2
Issues Go Daddy branded certificates to
Certification
authenticated organizations and individuals.
Authority
Starfield Services
Serves as a trusted root for time stamping certificates.
Root Certificate
Also reserved for general purpose usage in the future.
Authority
Starfield Services
Reserved for future use.
Root Certificate
Authority – G2

1.3.2 Registration Authorities
Registration Authorities (RAs) evaluate and either approve or reject Subscriber certificate
management transactions (including certificate requests, renewal and re-key requests, andrevocation requests). Starfield serves as the sole RA for the Starfield PKI.

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

2

Starfield CP-CPS V2.5

For the Starfield Root CAs the Subscribers are Subordinate CAs that are under the control ofStarfield. Accordingly, the RA function for these CAs is performed manually by authorized
Starfield PKI personnel.
For the Starfield Issuing CAs, the RA function is performed by Starfield using a combination of
automated and manual processes.
1.3.3 End Entities
End Entities include Subscribers and Relying Parties.
For the Root CAs, the Subscribers include subordinate CAs. For Starfield Issuing CAs,
Subscribers typically include organizations and individuals.
Relying Parties include any entity that may rely upon a Starfield certificate for purposes ofdetermining the organizational or individual identity of an entity providing a web site, dataencryption, digital signature verification, and user authentication.
1.3.4 Applicability
This CP/CPS is applicable to all certificates issued by Starfield CAs within the Starfield PKI.
This document defines the specific communities for which a specific class or type of certificate
is applicable, specific Starfield PKI practices and requirements for the issuance and managementof such certificates, and the intended purposes and uses of such certificates.
1.4

Contact Details

This CP/CPS is administered by the Starfield Governance and Policy Authority Committee.
Contact information is listed below:
Starfield Technologies, Inc.
14455 N. Hayden Road, Suite 219
Scottsdale, AZ 85260
Phone: 480-505-8800
Fax: 480-505-8865
E-mail: practices@starfieldtech.com
The Starfield Governance and Policy Authority Committee consists of representatives fromexecutive management, corporate security, PKI operations, and legal.
2

General Provisions

2.1

Obligations

2.1.1 Starfield Governance and Policy Authority Committee Obligations
Obligations of the Starfield Governance and Policy Authority Committee (GPAC) include:• Approving and maintaining this CP/CPS• Interpreting adherence to this CP/CPS
Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

3

Starfield CP-CPS V2.5

•••Specifying the content of public-key certificates
Resolving or causing resolution of disputes related to this CP/CPS
Remaining current regarding security threats and ensuring that appropriate actions aretaken to counteract significant threats.

2.1.2 Certification Authority Obligations
Obligations of the CAs within the Starfield PKI include:• Generating, issuing and distributing public key certificates• Distributing CA certificates• Generating and publishing certificate status information (such as CRLs)• Maintaining the security, availability, and continuity of the certificate issuance and CRL
signing functions• Providing a means for Subscribers to request revocation• Revoking public-key certificates• Periodically demonstrating internal or external audited compliance with this CP/CPS.
2.1.3 Repository Obligations
In providing Repository services, obligations of the Starfield PKI include:• Storing and distributing public-key certificates (where relevant)• Storing and distributing certificate status information (such as CRLs and/or online
certificate status)• Storing and distributing this CP/CPS and subsequent updates.
• Storing and distributing the Relying Party and Subscriber agreements.
2.1.4 Registration Authority Obligations
Obligations of the Registration Authorities (RAs) within the Starfield PKI include:• Obtaining a public-key from the Subscriber• Identifying and authenticating Subscribers in accordance with this CP/CPS• Verifying that the Subscriber possesses the asymmetric private key corresponding to the
public-key submitted for certification• Receiving, authenticating and processing certificate revocation requests• Providing suitable training to personnel performing RA functions.
2.1.5 Subscriber Obligations
Obligations of Subscribers within the Starfield PKI include:• Generating or causing to be generated one or more asymmetric key pairs• Submitting public keys and credentials for registration• Providing information to the RA that is accurate and complete to the best of the
Subscribers’ knowledge and belief regarding information in their certificates andidentification and authentication information• Taking appropriate measures to protect their private keys from compromise• Promptly reporting loss or compromise of private key(s) and inaccuracy of certificate
information• Using its key pair(s) in compliance with this CP/CPS.
Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

4

Starfield CP-CPS V2.5

2.1.6 Relying Party Obligations
Obligations of Relying Parties within the Starfield PKI include:• Confirming the validity of Subscriber public-key certificates• Verifying that Subscriber possesses the asymmetric private key corresponding to the
public-key certificate (e.g., through digital signature verification)• Using the public-key in the Subscriber’s certificate in compliance with this CP/CPS.
2.2

Liability

2.2.1 Warranties and Limitations on Warranties
The warranties, disclaimers of warranty, and limitations of liability among Starfield, its
Resellers, and their respective Customers within the Starfield PKI are set forth and governed by
the agreements among them. This CPS 2.2.1 relates only to the warranties that certain CAs(Starfield CAs) must make to end-Subscribers receiving Certificates from them and to Relying
Parties, the disclaimers of warranties they shall make to those Subscribers and Relying Parties,
and the limitations of liability they can place on those Subscribers and Relying Parties.
Starfield uses, and (where required) Resellers shall use, Subscriber agreements and Relying party
agreements in accordance with CPS 2. These Subscriber agreements shall meet the requirements
imposed by Starfield (in the case of Resellers). Requirements that Subscriber agreements
contain warranties, disclaimers, and limitations of liability below apply to those Resellers thatuse Subscriber agreements. Starfield agrees to such requirements in its Subscriber agreements.
Starfield’s practices concerning warranties, disclaimers, and limitations in Relying Parties
agreements apply to Starfield. Note that terms applicable to Relying Parties shall also be
included in Subscriber agreements, in addition to Relying party agreements, because subscribers
often act as Relying Parties as well.
Applicants, Subscribers, and Relying Parties acknowledge and agree that operations in relation toStarfield Certificates and Starfield Certificate Applications are dependent on the transmission of
information over communication infrastructures such as, without limitation, the Internet,
telephone and telecommunications lines and networks, servers, firewalls, proxies, routers,
switches, and bridges ("Telecommunication Equipment") and that this Telecommunication
Equipment is not under the control of Starfield or any independent third-party RA operating
under a Starfield CA, or any Resellers, Co-marketers, or any subcontractors, distributors, agents,
suppliers, employees, or directors of any of the foregoing. Neither Starfield nor any independent
third-party RA operating under a Starfield RA, or any Resellers, Co-marketers, or any
subcontractors, distributors, agents, suppliers, employees, or directorsof any of the foregoing shall be liable for any error, failure, delay, interruption, defect, or
corruption in relation to a Starfield Certificate, a Starfield CRL, a Starfield OCSP Response, or a
Starfield Certificate Application to the extent that such error, failure, delay, interruption, defect,
or corruption is caused by such Telecommunication Equipment.
2.2.1.1

Starfield Certification Authority Warranties to Subscribers and Relying Parties

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

5

Starfield CP-CPS V2.5

•
•
•

•
•
2.2.1.2

Starfield warrants that it is providing the Certificate Service with reasonable skill andcare
Starfield warrants that to the best of its knowledge there are no material
misrepresentations of fact in the Certificates known to or originating from the entities
approving the Certificate Applications or issuing the CertificatesStarfield warrants that there are no informational errors in the Certificates introduced by
the entities that approved the Certificate Applications or issued the Certificates as a resultof failing to exercise reasonable care in managing the Certificate Applications or creating
the CertificatesStarfield warrants that their Certificates meet all of the material requirements of this CPS
Starfield warrants that the Certificates, the revocation services and its use of a repository
conform to this CPS in all material respects
Loss Limitations

THE TOTAL CUMULATIVE LIABILITY OF STARFIELD, ANY INDEPENDENT THIRDPARTY RA OPERATING UNDER A STARFIELD CA, ANY RESELLERS, OR COMARKETERS, OR ANY SUBCONTRACTORS, DISTRIBUTORS, AGENTS, SUPPLIERS,EMPLOYEES, OR DIRECTORS OF ANY OF THE FOREGOING TO ANY APPLICANT,SUBSCRIBER, RELYING PARTY OR ANY OTHER PERSON, ENTITY, OR
ORGANIZATION ARISING OUT OF OR RELATING TO ANY STARFIELD CERTIFICATEOR ANY SERVICES PROVIDED IN RESPECT TO STARFIELD CERTIFICATES,INCLUDING ANY USE OR RELIANCE ON ANY STARFIELD CERTIFICATE, SHALLNOT EXCEED TWO THOUSAND UNITED STATES DOLLARS ($2000.00 U.S.)("CUMULATIVE DAMAGE LIMIT"). THIS LIMITATION SHALL APPLY PERSTARFIELD CERTIFICATE REGARDLESS OF THE NUMBER OF TRANSACTIONS OR
CAUSES OF ACTION ARISING OUT OF OR RELATED TO SUCH STARFIELDCERTIFICATE OR ANY SERVICES PROVIDED IN RESPECT TO SUCH STARFIELDCERTIFICATE. THE FOREGOING LIMITATIONS SHALL APPLY TO ANY LIABILITYWHETHER BASED IN CONTRACT (INCLUDING FUNDAMENTAL BREACH), TORT(INCLUDING NEGLIGENCE), LEGISLATION OR ANY OTHER THEORY OF LIABILITY,INCLUDING ANY DIRECT, INDIRECT, SPECIAL, STATUTORY, PUNITIVE,
EXEMPLARY, CONSEQUENTIAL, RELIANCE, OR INCIDENTAL DAMAGES.
STARFIELD, ANY INDEPENDENT THIRD-PARTY RA OPERATING UNDER A
STARFIELD CA, OR DIRECTORS OF ANY OF THE FOREGOING SHALL NOT BE
LIABLE TO ANY SUBSCRIBER, RELYING PARTY, OR ANY OTHER PERSON, ENTITY,
OR ORGANIZATION FOR ANY LOSSES, COSTS, EXPENSES, LIABILITIES, DAMAGES,
CLAIMS OR SETTLEMENT AMOUNTS ARISING OUT OF OR RELATING TO ANYPROCEEDING OR ALLEGATION THAT A STARFIELD CERTIFICATE OR ANY
INFORMATION CONTAINED IN A STARFIELD CERTIFICATE INFRINGES,MISAPPROPRIATES, DILUTES, UNFAIRLY COMPETES WITH, OR OTHERWISE
VIOLATES ANY PATENT, TRADEMARK, COPYRIGHT, TRADE SECRET, OR ANY
INTELLECTUAL PROPERTY RIGHT OR OTHER RIGHT OF ANY PERSON, ENTITY, OR
ORGANIZATION IN ANY JURISDICTION.

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

6

Starfield CP-CPS V2.5

SHOULD LIABILITY ARISING OUT OF OR RELATING TO A STARFIELDCERTIFICATE OR ANY SERVICES PROVIDED IN RESPECT TO A STARFIELDCERTIFICATE EXCEED THE CUMULATIVE DAMAGE CAP SET FORTH IN THISSECTION ABOVE, THE AMOUNTS AVAILABLE UNDER THE CUMULATIVE DAMAGE
CAP SHALL BE APPORTIONED FIRST TO THE EARLIEST CLAIMS TO ACHIEVE
FINAL DISPUTE RESOLUTION UNLESS OTHERWISE ORDERED BY A COURT OF
COMPETENT JURISDICTION. IN NO EVENT SHALL STARFIELD OR ANY
INDEPENDENT THIRD-PARTY RA OPERATING UNDER ANY STARFIELDCERTIFICATION AUTHORITY, OR ANY RESELLERS, CO-MARKETERS, OR ANY
SUBCONTRACTORS, DISTRIBUTORS, AGENTS, SUPPLIERS, EMPLOYEES, OR
DIRECTORS OF ANY OF THE FOREGOING BE OBLIGATED TO PAY MORE THAN THE
CUMULATIVE DAMAGE CAP FOR ANY STARFIELD CERTIFICATE OR ANYSERVICES PROVIDED IN RESPECT TO ANY STARFIELD SERVER CERTIFICATEREGARDLESS OF APPORTIONMENT AMONG CLAIMANTS.
STARFIELD, INDEPENDENT THIRD-PARTY RAs OPERATING UNDER A STARFIELDCERTIFICATION AUTHORITY, RESELLERS, CO-MARKETERS, OR ANY
SUBCONTRACTORS, DISTRIBUTORS, AGENTS, SUPPLIERS, EMPLOYEES, OR
DIRECTORS OF ANY OF THE FOREGOING SHALL NOT BE LIABLE FOR ANY
INCIDENTAL, SPECIAL, STATUTORY, PUNITIVE, EXEMPLARY, INDIRECT,RELIANCE, OR CONSEQUENTIAL DAMAGES (INCLUDING, WITHOUT LIMITATION,DAMAGES FOR LOSS OF BUSINESS, LOSS OF BUSINESS OPPORTUNITIES, LOSS OF
GOODWILL, LOSS OF PROFITS, BUSINESS INTERRUPTION, LOSS OF DATA, LOSTSAVINGS OR OTHER SIMILAR PECUNIARY LOSS) WHETHER ARISING FROMCONTRACT (INCLUDING FUNDAMENTAL BREACH), TORT (INCLUDINGNEGLIGENCE), LEGISLATION OR ANY OTHER THEORY OF LIABILITY.
THESE LIMITATIONS SHALL APPLY NOTWITHSTANDING THE FAILURE OF
ESSENTIAL PURPOSE OF ANY LIMITED REMEDY STATED HEREIN AND EVEN IF
STARFIELD OR ANY INDEPENDENT THIRD-PARTY
OPERATING UNDER A STARFIELD CERTIFICATION AUTHORITY, OR ANYRESELLERS, CO-MARKETERS, OR ANY SUBCONTRACTORS, DISTRIBUTORS,AGENTS, SUPPLIERS, EMPLOYEES, OR DIRECTORS OF ANY OF THE FOREGOINGHAVE BEEN ADVISED OF THE POSSIBILITY OF THOSE DAMAGES.
SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF
LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES, SO THESE
LIMITATIONS SET FORTH ABOVE MAY NOT APPLY TO CERTAIN APPLICANTS,
SUBSCRIBERS, RELYING PARTIES, OR OTHER PERSONS, ENTITIES, OR
ORGANIZATIONS. THE DISCLAIMERS OF REPRESENTATIONS, WARRANTIES, AND
CONDITIONS AND THE LIMITATIONS OF LIABILITY IN THIS STARFIELDCERTIFICATION PRACTICE STATEMENT CONSTITUTE AN ESSENTIAL PART OF
THE STARFIELD CPS, ANY SUBSCRIPTION AGREEMENTS, AND ANY RELYINGPARTY AGREEMENTS. ALL APPLICANTS, SUBSCRIBERS, RELYING PARTIES, AND
OTHER PERSONS, ENTITIES, AND ORGANIZATIONS ACKNOWLEDGE THAT BUT
FOR THESE DISCLAIMERS OF REPRESENTATIONS, WARRANTIES, AND
Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

7

Starfield CP-CPS V2.5

CONDITIONS AND LIMITATIONS OF LIABILITY, STARFIELD WOULD NOT ISSUE
STARFIELD CERTIFICATES TO SUBSCRIBERS AND NEITHER STARFIELD NOR ANY
INDEPENDENT THIRD-PARTY REGISTRATION AUTHORITIES OPERATING UNDER A
STARFIELD CERTIFICATION AUTHORITY, NOR ANY RESELLERS, CO-MARKETERS,OR ANY SUBCONTRACTORS, DISTRIBUTORS, AGENTS, SUPPLIERS, EMPLOYEES,OR DIRECTORS OF ANY OF THE FOREGOING WOULD PROVIDE SERVICES INRESPECT TO STARFIELD CERTIFICATES AND THAT THESE PROVISIONS PROVIDEFOR A REASONABLE ALLOCATION OF RISK.
In addition, Starfield is not liable for any loss:• of CA or RA services due to war, natural disasters or other uncontrollable forces;• incurred between the time a certificate is revoked and the next scheduled issuance of aCRL;
• due to unauthorized use of certificates issued by the Starfield PKI, or use of certificates
beyond the prescribed use defined by this CP/CPS;• arising from the negligent or fraudulent use of certificates or CRLs issued by the Starfield
PKI; or• due to disclosure of personal information contained within certificates.
2.2.1.3

Hazardous Activities

Starfield Certificates and the services provided by Starfield in respect to Starfield Certificates are
not designed, manufactured, or intended for use in or in conjunction with hazardous activities oruses requiring fail-safe performance, including the operation of nuclear facilities, aircraft
navigation or communications systems, air traffic control, medical devices or direct life support
machines. Starfield and any independent third-party RA operating under a Starfield CA, and any
Resellers, Co-marketers, and any subcontractors, distributors, agents, suppliers, employees, ordirectors of any of the foregoing specifically disclaim any and all representations, warranties,
and conditions with respect to such uses, whether express, implied, statutory, by usage of trade,or otherwise.
2.2.1.4

Other

Without limitation, neither Starfield nor any independent third-party RAs operating under aStarfield CA, nor any Resellers or Co-marketers, or any subcontractors, distributors, agents,
suppliers, employees, or directors of any of the foregoing shall be liable to any Applicants,
Subscribers, Relying Parties or any other person, entity, or organization for any losses, costs,
expenses, liabilities, damages, claims, or settlement amounts arising out of or relating to use of aStarfield Certificate or any services provided in respect to a Starfield Certificate if:(i) the Starfield Certificate was issued as a result of errors, misrepresentations, or other acts oromissions of a Subscriber or of any other person, entity, or organization;(ii) the Starfield Certificate has expired or has been revoked;(iii) the Starfield Certificate has been modified or otherwise altered;

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

8

Starfield CP-CPS V2.5

(iv) the Subscriber failed to stop using a Starfield Certificate after the information contained insuch Starfield Certificate changed or after circumstances changed so that the information
contained in such Starfield Certificate became misleading or inaccurate;(v) a Subscriber breached the Starfield CPS or the Subscriber's Subscription Agreement, or a
Relying Party breached the Starfield CPS or the Relying Party's Relying Party Agreement;(vi) the Private Key associated with the Starfield Certificate has been Compromised; or(vii) the Starfield Certificate is used other than as permitted by the Starfield CPS or is used incontravention of applicable law.
2.2.2 Disclaimer of Warranties
STARFIELD, ITS CAS, ITS RESELLERS, CO-MARKETERS, SUBCONTRACTORS,DISTRIBUTORS, AGENTS, SUPPLIERS, AND EMPLOYEES MAKE NO
REPRESENTATIONS AND EXPRESSLY DISCLAIM ALL WARRANTIES OF ANY KIND
EXCEPT THE LIMITED WARRANTY IN SECTION 2.2.1.1, WHETHER EXPRESS OR
IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NONINFRINGEMENT, TITLE, SATISFACTORY TITLE, AND ALSO INCLUDINGWARRANTIES THAT ARE STATUTORY OR BY USAGE OF TRADE. STARFIELD
MAKES NO WARRANTY THAT ITS SERVICE(S) WILL MEET ANY EXPECTATIONS,OR THAT THE SERVICE(S) WILL BE UNINTERRUPTED, TIMELY, SECURE, OR
ERROR FREE, OR THAT DEFECTS WILL BE CORRECTED. STARFIELD DOES NOTWARRANT, NOR MAKE ANY REPRESENTATIONS REGARDING THE USE, OR
RESULTS OF, ANY OF THE SERVICES WE PROVIDE, IN TERMS OF THEIR
CORRECTNESS, ACCURACY, RELIABILITY, OR OTHERWISE.
2.2.3 Subscriber Liability
2.2.3.1

Subscriber Warranties

Subscribers are obligated by Starfield’s Subscriber Agreements to warrant that, among otherthings:•All digital signatures created using the private key corresponding to the public key listed
in the Certificate belong to that Subscriber and the Certificate has been accepted and isfunctional – it has not expired or been revoked - at the time the digital signature iscreated,•No unauthorized users have had access to the Subscriber's private key,•

All representations in the Certificate Application by the Subscriber are true,•

The information from the Subscriber in the Certificate is true,

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

9

Starfield CP-CPS V2.5

•

Any usage of the Certificate is for authorized and lawful reasons only, consistent
with this CPS,•The Subscriber is not a CA but is an end-user Subscriber and is not using the private key
corresponding to any public key listed in the Certificate for purposes of digitally signing
any Certificate (or any other format of certified public key) or CRL, as a CA orotherwise (with the exception of signing code with a Code Signing Certificate), and•The Subscriber is not using the Certificate Service in any way that infringes upon therights of third parties.

•

The Subscriber is not using their Code Signing Certificate to digitally sign hostile code,
including spyware or other malicious software (malware) downloaded without user
consent.

These requirements shall be in other Subscriber Agreements.
2.2.3.2

Private Key Compromise

The Subscriber Agreements provide that if Subscribers fail to meet the PKI requirements andtheir private key is compromised, they are solely responsible for any loss or damage resulting
from such failure.
2.2.4 Other Exclusions
No stipulation.
2.3

Financial Responsibility

Subscribers and Relying Parties shall be responsible for the financial consequences to such
Subscribers, Relying Parties, and to any other persons, entities, or organizations for any
transactions in which such Subscribers or Relying Parties participate and which use Starfield
Certificates or any services provided in respect to Starfield Certificates. Starfield makes norepresentations and gives no warranties or conditions regarding the financial efficacy of any
transaction completed utilizing a Starfield Certificate or any services provided in respect toStarfield Certificates and neither Starfield nor any independent third-party RA operating under aStarfield CA, nor any Resellers, Co-marketers, nor any subcontractors, distributors, agents,
suppliers, employees, or directors of any of the foregoing shall have any liability except as
explicitly set forth herein in respect to the use of or reliance on a Starfield Certificate or any
services provided in respect to Starfield Certificates.
2.3.1 Indemnification by Subscribers and Relying Parties
2.3.1.1 Indemnification by Subscribers
Starfield's Subscriber Agreement and other Subscriber Agreements shall require Subscribers toindemnify, to the extent permitted by law, Starfield and any non-Starfield CAs or RAs against
Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

10

Starfield CP-CPS V2.5

any and all liabilities, losses, costs, expenses, damages, claims, and settlement amounts(including reasonable attorney’s fees, court costs, and expert’s fees) arising out of or relating to
any use or reliance by a Relying Party on any Starfield Certificate or any service provided in
respect to Starfield Certificates, including:•

Any false statement, omission or misrepresentation of fact that the Subscriber has put on
the Subscriber's Certificate Application,•

Any modification made by the Subscriber to the information contained in a Starfield
Certificate,•The use of a Starfield Certificate other than as permitted by the Starfield CPS, theSubscription agreement, any Relying Party agreement, and applicable law,•

The Subscriber's failure to use a secure system, protect the Subscriber's private key, or tootherwise take the precautions necessary to prevent the compromise, loss,
disclosure, modification, or unauthorized use of the Subscriber's private key, or•

The Subscriber's use of a name (including without limitation within a common name,domain name, or e-mail address) that infringes upon the Intellectual Property Rights of athird party.

2.3.1.2

Indemnification by Relying Parties

Starfield's Subscriber Agreements and Relying Party Agreements shall require Relying Parties toindemnify Starfield and any non-Starfield CAs or RAs against, to the extent permitted by law,
any and all liabilities, losses, costs, expenses, damages, claims, and settlement amounts(including reasonable attorney’s fees, court costs, and expert’s fees) arising out of or relating to
any use or reliance by a Relying Party on any Starfield Certificate or any service provided in
respect to Starfield Certificates, including:•

Any failure by the Relying Party to perform the obligations of a Relying Party,•

Lack of proper validation of a Starfield Certificate by a Relying Party,•

Use of a Starfield Certificate other than as permitted by the Starfield CPS, theSubscription agreement, any Relying Party agreement, and applicable law,•

Failure by a Relying Party to exercise reasonable judgment in the circumstances inrelying on a Starfield Certificate.

•

Reliance by a Relying Party on a Certificate that is not reasonable under thecircumstances, or•

The failure of a Relying Party to check the status of such Certificate to determine if it isexpired or revoked.
Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

11

Starfield CP-CPS V2.5

2.3.2 Fiduciary Relationships
Starfield is not the agent, fiduciary, trustee, or other representative of Subscribers or Relying
Parties. Starfield’s Subscriber agreements and Relying party agreements shall disclaim, to theextent permitted by law, any fiduciary relationship between Starfield or a non-Starfield CA or
RA, and between a Subscriber or Relying party.
2.3.3 Administrative Processes
No stipulation.
2.4

Interpretation and Enforcement

2.4.1 Governing Law
The laws of the state of Arizona, USA, shall govern the enforceability, construction,interpretation, and validity of this CPS, subject to any limits appearing in applicable law, andregardless of contract or other choice of law provisions and without the requirement to establish
a commercial nexus in Arizona, USA. The choice of law is made to create uniform procedures
and interpretation for all Starfield PKI participants, no matter where they are located.
This governing law provision applies only to this CPS. Agreements incorporating the CPS byreference may have their own governing law provisions, provided that this CPS 2.4.1 governs theenforceability, construction, interpretation, and validity of the terms of the CPS separate andapart from the remaining provisions of any such agreements, subject to any limitations appearing
in applicable law.
Any applicable national, state, local and foreign laws, rules, regulations, ordinances, decrees, andorders including, but not limited to, restrictions on exporting or importing software, hardware, or
technical information shall apply to this CPS.
2.4.2

Severability, Survival, Merger and NoticeThis CP/CPS shall be binding on all successors of the parties.
If any provision of this CP/CPS is found to be unenforceable, the remaining provisions shall beinterpreted to best carry out the reasonable intent of the parties. It is expressly agreed that every
provision of this CP/CPS that provides for a limitation of liability or exclusion of damages,
disclaimer or limitation of any warranties, promises or other obligations, is intended to be
severable and independent of any other provision and is to be enforced as such.
This CPS shall be interpreted consistently with what is commercially reasonable in good faithunder the circumstances and considering its international scope and uniform application. Failureby any person to enforce a provision of this CP/CPS will not be deemed a waiver of future
enforcement of that or any other provision.

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

12

Starfield CP-CPS V2.5

Any notice, demand, or request pertaining to this CP/CPS shall be communicated either using
email consistent with this CP/CPS, or in writing. Electronic communications shall be effective
when received by the intended recipient.
2.4.3 Dispute Resolution Procedures
In the event of any dispute involving the services or provisions covered by this CP/CPS, theaggrieved party shall notify Starfield management regarding the dispute. Starfield management
will involve the appropriate Starfield personnel to resolve the dispute.
2.5
2.5.1

Fees
Certificate Issuance or Renewal Fees

Starfield and Customers may charge end-user Subscribers for the issuance, management, andrenewal of Certificates.
2.5.2

Certificate Access Fees

Starfield reserves the right to charge a fee for making a Certificate available in a repository orotherwise.
2.5.3

Status Information Access or Revocation Fees

Starfield does not charge a fee as a condition of making the CRLs required by CPS §4.4.9
available in a repository or otherwise available to Relying Parties. Starfield reserves the right tocharge a fee for providing customized CRLs, OCSP services, or other value-added revocationand status information services. Starfield does not permit access to revocation information,
Certificate status information, or time stamping in its repository by third parties that provide
products or services that utilize such Certificate status information without Starfield’s prior
express written consent.
2.5.4

Fees for Other Services Such as Policy Information

Starfield does not charge a fee for accessing this CPS or the CP. However, any use of the CPS
for purposes other than viewing the document, including reproduction, redistribution,
modification, or creation of derivative works, may be subject to a license agreement with theentity holding the copyright to the document.
2.5.5

Refund Policy

The following refund policy is in effect:
Starfield employs strict practices and policies in its certification operations and in issuingcertificates. If for any reason a Subscriber is not completely satisfied with the certificate that has
been issued to the Subscriber, the Subscriber may ask Starfield to revoke the certificate within 30
days of issuance for a refund, minus any fees. Following the initial 30 day period, a Subscriber
Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

13

Starfield CP-CPS V2.5

may ask Starfield to revoke the certificate and provide a refund if Starfield has breached awarranty or other material obligation under this CPS relating to the Subscriber or the subscriber's
certificate. After Starfield revokes the subscriber's certificate, Starfield will promptly credit the
Subscriber's credit card account (if the certificate was paid for via credit card) or otherwise
reimburse the Subscriber via check, for the full amount minus fees, of the amount paid for thecertificate. To request a refund, please call customer service at 1+(480) 505-8855. This refund
policy is not an exclusive remedy and does not limit other remedies that may be available tosubscribers.
2.6

Publication and Repository

2.6.1 Publication of CA Information
This CP/CPS is published in the Starfield repository at http://www.starfieldtech.com/repository/
in accordance with the provisions of §8 of this CPS.
2.6.2 Frequency of Publication
This CP/CPS is published in accordance with §2.6.1. CRLs are published in accordance with
§4.4.9.
2.6.3 Access Controls
Read access to the Starfield repository is unrestricted. Write access to the repository is restricted
to authorized Starfield PKI personnel through the use of appropriate logical access controls.
2.6.4 Repositories
The Starfield repository shall contain the current and historical versions of this CP/CPS, afingerprint of the Starfield Root CAs, current CRLs for the Starfield CAs, and other information
relevant to Subscribers and Relying Parties.
Starfield also maintains a database of issued certificates and CRLs to which access is restricted
to authorized Starfield PKI personnel.
The Starfield Repository is located at http://www.starfieldtech.com/repository
2.7

Compliance Audit

2.7.1 Frequency of Entity Compliance Audit
The Starfield PKI is subject to an annual WebTrust for Certification Authorities (WebTrust forCAs) examination. The Starfield PKI is also subject to an annual WebTrust for Extended
Validation (WebTrust for EV) examination, as it relates to the issuance of Extended Validation
certificates from the Starfield issuing CAs.

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

14

Starfield CP-CPS V2.5

2.7.2 Identity/Qualifications of Auditor
Auditors demonstrating proficiency in public key infrastructure technology, information security
tools and techniques, security auditing, and the third-party attestation function shall perform theannual WebTrust for CAs and WebTrust for EV examinations. The audit firm must be currently
licensed to perform WebTrust for CA audits and WebTrust EV Program audits, be a member ofthe American Institute of Certified Public Accountants (AICPA), and maintain professional
liability/errors & omissions insurance with policy limits of at least $1 million in coverage.
2.7.3 Auditor's Relationship to Audited Party
The entity that performs the annual audit shall be organizationally independent of Starfield.
2.7.4 Topics Covered by Audit
The scope of the annual audit shall include the requirements of this CP/CPS, CA environmental
controls, CA key management, and certificate life cycle management.
2.7.5 Actions Taken as a Result of an Audit Deficiency
Significant deficiencies identified during the compliance audit will result in a determination ofactions to be taken. The Starfield Governance and Policy Authority Committee makes thisdetermination with input from the auditor. Starfield Management is responsible for ensuring that
corrective action plans are promptly developed and corrective action is taken within a period oftime commensurate with the significance of such matters identified.
Should a severe deficiency be identified that might compromise the integrity of the Starfield
PKI, Starfield Management will consider, with input from the auditor, whether suspension ofStarfield PKI operations is warranted. Should a severe deficiency be identified that might
compromise the integrity of a particular CA, Starfield PKI Management will assess whether
suspension of the particular CA’s operations is warranted.
2.7.6 Communication of Results
Compliance audit results are communicated to Starfield Management and others deemed
appropriate by Starfield Management.
2.8

Confidentiality

2.8.1 Types of Information to be Kept Confidential
Sensitive Starfield PKI information must remain confidential to Starfield. The following
information is considered confidential to Starfield and may not be disclosed:• Starfield PKI policies, procedures and technical documentation supporting this CP/CPS• Subscriber registration records, including:- Certificate applications, whether approved or rejected- Proof of identification documentation and details- Certificate information collected as part of the registration records, beyond that whichis required to be included in Subscriber certificates
Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

15

Starfield CP-CPS V2.5

•••

Audit trail records
Any private key within the Starfield PKI hierarchy
Compliance audit results except for WebTrust for CAs audit reports which may be
published at the discretion of Starfield Management

2.8.2 Types of Information not Considered Confidential
This CP/CPS and Certificates and CRLs issued by Starfield are not considered confidential.
2.8.3 Disclosure of Certificate Revocation Information
Subscriber certificate status information is made available to Relying Parties through the use of
CRLs. The transactional records and other information leading up to a certificate revocation are
considered confidential information.
2.8.4 Release to Law Enforcement Officials
As a general principle, no document or record (including registration records) belonging to orcontrolled by the Starfield PKI is released to law enforcement agencies or officials except where
the law enforcement official is properly identified and where the release of specific informationis:• required by applicable laws or regulations• pursuant to a subpoena or order of a court or other government or regulatory authority
with which Starfield is legally obligated to comply• pursuant to a demand made by any government regulatory agency or authority withjurisdiction over Starfield.
2.8.5 Release as Part of Civil Discovery
As a general principle, no document or record belonging to or controlled by the Starfield PKI isreleased to any person except where:• a properly constituted instrument requiring production of the information is produced and• the person requiring production is a person authorized to do so by a court of law and isproperly identified.
2.8.6 Disclosure Upon Owner's Request
No stipulation.
2.8.7 Other Information Release Circumstances
No stipulation.
2.9Intellectual Property Rights

Intellectual Property Rights among Starfield PKI Participants other than Subscribers and Relying
Parties are governed by the applicable agreements among such Starfield PKI Participants. The
following subsections of CPS 2.9 apply to Intellectual Property Rights in relation to Subscribers
and Relying Parties.
Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

16

Starfield CP-CPS V2.5

2.9.1. Property Rights in Certificates and Revocation Information
The Intellectual Property Rights pertaining to the Certificates of CAs and revocation informationthat are issued by CAs shall be retained by those CAs. Provided the Certificates are reproducedin full and that use of such Certificates is subject to the Relying Party agreement, Starfield andSubscribers grant permission to reproduce and distribute the Certificates on a nonexclusive
royalty-free basis. Starfield and Subscribers shall grant permission to use revocation information
to perform Relying Party functions subject to the applicable Relying party agreement or any
other applicable agreements.
2.9.2 Property Rights in the Agreement
Starfield PKI Participants acknowledge that Starfield retains all Intellectual Property Rights inand to this CPS.
2.9.3 Property Rights to Names
Certificate applicants retain all rights, if they have any, in any trademark, service mark, or tradename contained in any Certificate Application and distinguished name within any Certificate
issued to them. Starfield retains all rights it has in any trademark, service mark, trade name, orother identifying trade symbols that it owns.
2.9.4 Property Rights in Keys and Key Material
All Key Pairs corresponding to Certificates of CAs and end-user Subscribers are the property of
those CAs and end-users, regardless of where they are stored physically, and those persons retain
all Intellectual Property Rights in and to those key pairs. Without limiting the generality of theforegoing, Starfield’s Root CA Public keys and the root Certificates containing them are theproperty of Starfield. Starfield grants licenses to software and hardware manufacturers to
reproduce such root Certificates to place copies in trustworthy hardware devices or software.
Finally, without limiting the generality of the foregoing, Secret Shares of a CA’s private key are
the property of the CA, and the CA retains all Intellectual Property Right in and to such Secret
Shares.
The following are the property of Starfield:• This CPS• Starfield-specified Certificate Policies• Policies and procedures supporting the operation of the Starfield PKI• Starfield-specified Object Identifiers (OIDs)• Certificates and CRLs issued by Starfield CAs• Distinguished Names (DNs) used to represent entities within the Starfield PKI• CA and infrastructure key pairs

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

17

Starfield CP-CPS V2.5

3

Identification and Authentication

3.1

Initial Registration

3.1.1 Types of Names
All certificate holders require either a Distinguished Name in the Subject field that is incompliance with the X.500 standard for Distinguished Names, or a set of Subject Alternative
Name values in the Subject Alternative Name extension. In the case where subject identity
information is contained solely in the Subject Alternative Name extension, the Subject field of
the certificate shall be empty. The Starfield PKI approves naming conventions for the creationof distinguished names and Subject Alternative Name values for certificate applicants.
The Issuer and Subject Distinguished Name fields for Certificates issued by Starfield are
populated in accordance with §7.1.
3.1.2 Need for Names to be Meaningful
For Starfield PKI certificates that contain a Distinguished Name in the Subject field, said
Distinguished Names shall be meaningful. For Starfield PKI certificates with an empty Subject
field, any information contained in the Subject Alternative Name extension may or may not bemeaningful depending on the type and intended use of the certificate.
3.1.3 Rules for Interpreting Various Name Forms
Name forms are interpreted in accordance with §3.1.1 and 3.1.2.
3.1.4 Uniqueness of NamesDistinguished Names of Extended Validation and High Assurance SSL certificates are to beunambiguous and unique within the Starfield CA’s domain, except in the case of a single
Subscriber who is permitted to have multiple active certificates with identical Subject
Distinguished Names. Multiple Medium Assurance and Code Signing certificates containing thesame Subject Distinguished Name are permitted within the Starfield CA’s domain.
No stipulation is made of the uniqueness of any naming information contained within the custom
certificate types specified in §7.1.6.
3.1.5 Name Claim Dispute Resolution Procedure
Certificate Applicants are prohibited from using names in their Certificate Applications that
infringe upon others’ Intellectual Property Rights. Starfield does not verify whether a Certificate
Applicant has Intellectual Property rights in the name appearing in a Certificate Application nor
does Starfield arbitrate, mediate, prosecute, or otherwise resolve any dispute concerning theownership of any domain name, trade name, trademark, or service mark. Starfield may, without
liability to any Certificate applicant, reject or suspend any Certificate application because of suchdispute.

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

18

Starfield CP-CPS V2.5

3.1.6 Recognition, Authentication and Role of Trademarks
See §3.1.5.
3.1.7 Method to Prove Possession of Private Key
The Subscriber’s certificate request must contain the public key to be certified and be digitally
signed with the corresponding private key.
3.1.8 Authentication of Organization Identity
For High Assurance organizational Subscribers, Starfield verifies the following:• the organization name represents an organization currently registered with a government
authority• the individual requesting the certificate has access to the domain name(s) that are
specified in the certificate application• the individual requesting the certificate is authorized to do so by the organization namedin the certificate
3.1.9 Authentication of Individual Identity
For High Assurance individual Subscribers, Starfield verifies the following:• the identity of the individual named in the certificate application• the individual requesting the certificate has access to the domain name(s) that are
specified in the certificate application
In the case of a small business/sole proprietorship that is not registered with a government
authority, Starfield will optionally include the entity’s “doing business as” (DBA) name in an
informational, unauthenticated “organizational unit” (OU) field.
3.1.10 Unified Communications Certificate Authentication
The individual requesting the certificate is confirmed to have access to every fully qualified
domain name included in the Subject Common Name or Subject Alternative Name fields of a
UCC certificate. Only one Organization (as described in §3.1.8) or Individual (as described in§3.1.9) is authenticated for each High Assurance UCC certificate.
3.1.11 Medium Assurance Authentication
For Medium Assurance Subscribers, Starfield verifies the following:• the individual requesting the certificate has access to the domain name(s) that are
specified in the certificate application
3.1.12 Authentication of Organization Identity for Extended Validation Certificates
For Extended Validation Subscribers, Starfield verifies the following in accordance with the
CA/Browser Forum Guidelines for the Issuance and Management of Extended Validation
Certificates:
Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

19

Starfield CP-CPS V2.5

•
•
•
•
•
•

Legal Existence and Identity
Assumed Name (optional)
Physical Existence
Operational Existence (if records indicate that the organization is less than three years
old)Domain ownership or exclusive right to use
Name, title, and authority of contract signer, and certificate approver

3.1.13 Code Signing Certificate Authentication
For High Assurance Code Signing Subscribers, Starfield verifies the following:• the organization name represents an organization currently registered with a government
authority• the individual requesting the certificate is authorized to do so by the organization namedin the certificate
3.1.14 Custom Certificate Authentication
Starfield may issue certificates designed for use in a specific peer-to-peer application. Thesecertificates are designed for use only in that application and steps are taken to ensure that they
will not function for standard uses such as SSL or code signing. For certificates issued for a
specialized usage, Starfield verifies the following:• information contained in the certificate that identifies a person or organization has beenvalidated• the requestor possesses a valid license key for the product on which the certificate will be
used
3.2

Routine Re-key

Routine re-key of CAs is performed in accordance with §4.9.
Subscribers are permitted to reuse a previous certificate request to replace an expiring or expired
Certificate.
Where the Subscriber holds a certificate and the initial Subscriber identification andauthentication process (as described in §3.1.8 - 3.1.14) has been performed within the previous
13 months, Starfield may authenticate a renewal certificate request using a shared secret.
3.3

Re-key After Revocation

In the event that a Starfield CA certificate must be revoked, the CA will be re-keyed inaccordance with §4.9 or terminated in accordance with §4.10.
The process for re-key after revocation of a Subscriber certificate is complete re-enrollment,
which requires the generation of a new Subscriber key pair and the re-performance of the initial
Subscriber identification and authentication procedures specified in §3.1.8 -- 3.1.14.

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

20

Starfield CP-CPS V2.5

3.4

Certificate Renewal

Certificate renewal, defined as the process whereby a new certificate with an extended validity
period is created for an existing Distinguished Name, is permitted for CA Certificates inaccordance with §4.9.
Certificate renewal for end-user Subscriber certificates is supported via the routine re-key
process described in §3.1.12.
3.5

Revocation Request

Subscriber certificate revocation requests may be submitted by the Subscriber via an online
certificate revocation request page. Such requests are authenticated using a shared secret.
If the revocation request cannot be authenticated using a shared secret, the RA must perform
sufficient procedures to authenticate the revocation request in accordance with Starfield’s
revocation request processing procedures.
3.6

Suspension Request

See §4.4.
3.7

Request to Release Suspension

See §4.4.
4Operational Requirements

4.1

Certificate Application

Certificate applications must include all information required by the relevant Starfield certificate
application form.
4.2

Certificate Issuance

Certificates are generated, issued and published only after the RA performs the required
identification and authentication steps in accordance with §3.1.8 - 3.1.9.
4.3

Certificate Acceptance

A Subscriber’s receipt of a certificate and subsequent use of the key pair and certificate
constitute certificate acceptance. By accepting a certificate, the Subscriber:• Agrees to be bound by the continuing responsibilities, obligations and duties imposed bythis CP/CPS,• Agrees to be bound by the Subscribing Party agreement, and• Represents and warrants that to its knowledge no unauthorized person has had access tothe private key associated with the certificate, andCopyright © 2009 Starfield Technologies, Inc. All rights reserved.

21

Starfield CP-CPS V2.5

•

4.4

Represents and warrants that the certificate information it has supplied during theregistration process is truthful and has been accurately and fully published within thecertificate.
Certificate Suspension and Revocation

Starfield supports certificate revocation for all Starfield CAs. Starfield does not support
certificate suspension.
4.4.1 Circumstances for Revocation
A certificate may be revoked under any or all of the following circumstances:• The Subscriber or authorized Reseller on behalf of the Subscriber requests certificate
revocation in accordance with §3.5.
• The certificate subject can be shown to have violated the stipulations of this CP/CPS, orcompromise the security or integrity of the Starfield PKI.
• The Subscriber can be shown to have violated the stipulations of the Subscriber
Agreement.
• Compromise of the Subscriber’s private key is known or suspected.
• The authenticated organization or individual name in the Subject field of the Subscriber’s
certificate changes before the certificate expires.
• The Subscriber fails to pay any invoice from Starfield within forty-five (45) days ofreceiving it.
4.4.2 Who Can Request Revocation
Subscriber certificate revocation can be initiated by the Subscriber, Starfield, or authorized
Resellers.
4.4.3 Procedure for Revocation Request
Subscriber certificate revocation requests are authenticated using a shared secret or in accordancewith Starfield’s revocation request processing procedures.
4.4.4 Revocation Request Grace Period
Starfield validates automated revocation requests (i.e., where a shared secret is correctly
provided) on receipt. Starfield commences the validation of non-automated revocation requests
within one business day of receipt.
Starfield immediately processes authenticated revocation requests. A certificate’s revoked statusis reflected on a CRL published within seven days of the processing of an authenticatedrevocation request. Revoked certificates are listed in the CRL until the certificate expires, withthe exception of Code Signing certificates which are retained on the CRL after certificate
expiration.
4.4.5 Circumstances for Suspension
Not applicable.
Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

22

Starfield CP-CPS V2.5

4.4.6 Who Can Request Suspension
Not applicable.
4.4.7 Procedure for Suspension Request
Not applicable.
4.4.8 Limits on Suspension Period
Not applicable.
4.4.9 CRL Issuance Frequency
CRLs for Starfield CAs are issued in accordance with the following table.
CA TypeRoot CAs
Issuing CAs

CRL Publication Frequency
Every 365 days or less and upon certificate revocation
Every 7 days or less4.4.10 CRL Checking Requirements
Relying Parties are required to check certificate status using the applicable CRL and/or OCSP
before relying upon a certificate.
4.4.11 Online Revocation/Status Checking Availability
OCSP responses for Starfield CAs are issued in accordance with the following table.
CA Type
OCSP Update Frequency
Root CAs
Every 365 days or less and upon certificate revocation if OCSP isenabled for the Root CA
Issuing CAs
Every 4 days or less4.4.12 Online Revocation Checking Requirements
No stipulation.
4.4.13 Other Forms of Revocation Advertisements Available
No stipulation.
4.4.14 Checking Requirements for Other Forms of Revocation Advertisements
No stipulation.
4.4.15 Special Requirements for Key Compromise
There is no deviation from the certificate revocation procedures specified above when the
revocation of a Subscriber certificate is due to private key compromise.

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

23

Starfield CP-CPS V2.5

In addition to the procedures specified above, if deemed necessary, Starfield uses commerciallyreasonable efforts to notify potential Relying Parties if Starfield discovers, or has reason tobelieve, that there has been a compromise of a Starfield CA private key.
4.5

Certificate Problem Reporting and Response

4.5.1 Reporting
The Starfield PKI allows Subscribers, Relying Parties, Application Software Vendors, and otherthird parties to report complaints or suspected Private Key compromise, EV Certificate misuse,or other types of fraud, compromise, misuse, or inappropriate conduct related to EV Certificates
via email or telephone as published in the Starfield repository.
4.5.2 Investigation
Starfield will begin investigation of all certificate problem reports within twenty-four (24) hours
and decide whether revocation or other appropriate action is warranted based on at least thefollowing criteria:(i) The nature of the alleged problem;(ii) Number of Certificate Problem Reports received about a particular EV
Certificate or website;(iii)The identity of the complainants (for example, complaints from a law
enforcement official that a web site is engaged in illegal activities have moreweight than a complaint from a consumer alleging they never received thegoods they ordered); and(iv) Relevant legislation in force.
4.5.3 Response
Starfield maintains a continuous 24/7 ability to respond to any high priority certificate problem
reports and to revoke certificates in accordance with §4.4 and/or report the problem to law
enforcement officials.
4.6

Security Audit Procedures

4.6.1 Types of Events Recorded
The Starfield PKI logs the following events:• Significant CA key life cycle management events including CA key generation backup,
storage, archival, and destruction and other cryptographic device lifecycle management
events• CA and Subscriber certificate life cycle management events- Requests for certificates, renewal, re-key, and revocation- Successful or unsuccessful processing of requests- Generation and issuance of certificates- Revocation of certificates- Issuance of CRLs and generation of OCSP entries
Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

24

Starfield CP-CPS V2.5

•

•
•

All verification activities required by applicable guidelines
Date, time, phone number used, persons spoken to, and end results of verification
telephone calls
Security-sensitive operating system events- Successful and unsuccessful PKI system access attempts;- PKI and security system actions performed;- Security profile changes;- System crashes, hardware failures, and other anomalies;- Firewall and router activities; and- Entries to and exits from CA facility
CA facility entry/exit.
Separation of validation duties between multiple RAs for Extended Validation certificates

4.6.2 Required Data Elements
All audit logs include, at a minimum:- Date and time of entry- Identity of the persona and entity making the journal entry- Description of entry
4.6.3 Frequency of Processing Log
Audit logs are reviewed on an as-needed basis.
4.6.4 Retention Period for Audit Log
Audit logs are retained as follows:
Log Type
Logs of CA key management activity
CA system logs of certificate management activity
Operating system logs
Physical access system logs
Manual logs of physical accessVideo recording of CA facility access

Retention Period
30 years
30 years
5 years
5 years
5 years
90 days

4.6.5 Protection of Audit Log
Production and archived logical and physical audit logs are protected using a combination ofphysical and logical access controls.
4.6.6 Audit Log Backup Procedures
Audit logs are backed up on a periodic basis.
4.6.7 Audit Collection System (Internal vs. External)
Automated audit data is generated and recorded at the application, network, and operating
system level. Manually generated audit data is recorded by Starfield employees.
Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

25

Starfield CP-CPS V2.5

4.6.8 Notification to Event-Causing Subject
Where an event is logged by the audit collection system, no notice is required to be given to theindividual or system that caused the event.
4.6.9 Vulnerability Assessments
Starfield performs periodic vulnerability assessments of its PKI environment. The results ofsuch assessments are used to enhance the security of the environment.
4.7

Records Archival

The Starfield PKI maintains an archive of relevant records for each CA.
4.7.1 Types of Event Recorded
Starfield maintains an archive of logs that include the recorded events specified in §4.6.1.
4.7.2 Retention Period for Archive
Starfield archives and retains audit logs in accordance with §4.6.4.
4.7.3 Protection of ArchiveSee §4.6.5.
4.7.4 Archive Backup Procedures
Starfield maintains copies of its archived records at separate locations.
4.7.5 Requirements for Time-Stamping of Records
Starfield PKI system clocks are synchronized with a third party time source. Automated journal
entries include a system generated date and time field. Manual journal entries include amanually entered date and time field.
4.7.6 Archive Collection System (Internal or External)
No stipulation.
4.7.7 Procedures to Obtain and Verify Archive Information
No stipulation.
4.8

Key Changeover

Starfield CAs will stop issuing certificates and will be re-keyed or terminated before themaximum key usage period for certificate signing is reached in accordance with §6.3.2. The CA
will continue to sign and publish CRLs until the end of the CA certificate lifetime. The key
changeover or CA termination process will be performed such that it causes minimal disruption
to Subscribers and Relying Parties. Affected entities will be notified prior to the planned key
changeover.
Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

26

Starfield CP-CPS V2.5

4.9

Compromise and Disaster Recovery

To enable the recovery its PKI operations in the event of a disaster, Starfield has implemented
the following:• Secure storage of backup cryptographic hardware modules containing copies of theStarfield CA private keys at an alternate location• Secure storage of the requisite activation materials at an alternate location• Secure storage of backups of system, data, and configuration information• Secured disaster recovery site where operations can be restored in the event of a disasterat Starfield’s primary location• Disaster recovery plan
• Periodic disaster recovery plan testing.
Starfield has implemented a combination of physical, logical and procedural controls to guard
against CA key compromise. In the event of a known or suspected CA key compromise,
Starfield management will assess the situation and determine the appropriate course of action.
4.10 CA Termination
In the event that it is necessary to terminate the operation of a Starfield CA, Starfieldmanagement will plan and coordinate the termination process with its Subscribers and Relying
Parties such that the impact of the termination is minimized. Starfield will provide as much priornotice as is practicable and reasonable to Subscribers and Relying Parties and preserve relevant
records for a period of time deemed fit for functional and legal purposes. Relevant certificateswill be revoked no later than the time of the termination.
5

Physical, Procedural and Personnel Security Controls

5.1

Physical Controls

5.1.1 Site Location and Construction
Starfield PKI systems are hosted and managed using secure facilities in the Scottsdale, Arizonaarea with multiple levels of physical access controls.
5.1.2 Physical Access
Production Starfield PKI systems are housed in a secure facility requiring two factor
authentication and dual control access to any physical device in the CA environment. Physicalaccess to the CA facility is automatically logged and video recorded on a 24x7 basis. Physicalaccess to the CA facility is monitored 24x7 by onsite security personnel.
5.1.3 Power and Air Conditioning
The supply of power to Starfield CA systems is protected through the use of UPS systems andgenerators. Climate control systems have been implemented to ensure that the temperature
within the CA facility is maintained within reasonable operating limits.
Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

27

Starfield CP-CPS V2.5

5.1.4 Water Exposures
The CA hosting facility has been verified to reside outside of any designated 100-year flood
plain.
5.1.5 Fire Prevention and Protection
The Starfield CA hosting facility is equipped with a smoke detection system and a pre-action dry
pipe fire suppression system.
5.1.6 Media Storage
Media containing production software, production data, and system audit information is stored
secured with appropriate physical and logical access controls designed to limit access toauthorized personnel.
5.1.7 Offsite Backup
Offsite backup media are stored in a physically secure manner using a bonded third party storage
facility.
5.1.8 Waste Disposal
Sensitive documents and materials are shredded before disposal. Media used to collect ortransmit sensitive information are rendered unreadable before disposal. Other waste is disposedof in accordance with Starfield’s normal waste disposal requirements.
Cryptographic devices, smart cards, and other devices that may contain private keys or keying
material are physically destroyed or zeroized in accordance the manufacturers’ guidance prior todisposal.
5.2

Procedural Controls

5.2.1 Trusted Roles
All Starfield personnel involved in the operation of the Starfield PKI are considered to serve in“trusted roles.” Within the Starfield PKI, the following trusted roles exist:• Security, responsible for establishing and monitoring compliance with security policies,
procedures, and standards.
• Engineering/Architecture, responsible for the design and development of Starfield PKI
systems.
• PKI Operations, responsible for administering, maintaining and monitoring the systems
supporting the Starfield PKI.
• Key Management, responsible for management of cryptographic materials.
• RA Operations, responsible for processing certificate requests and revocation requests.
5.2.2 Number of Persons Required Per Task
Cryptographically sensitive operations within the Starfield PKI such as CA key generation, CA
key recovery, CA key activation and CA system configuration require the participation of
Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

28

Starfield CP-CPS V2.5

multiple “trusted” individuals in accordance with §6.2.2. Other operations may require only one
trusted individual.
5.2.3 Identification and Authentication for Each Role
Each person performing a trusted role within the Starfield PKI must be authorized bymanagement to perform such functions and must satisfy the personnel requirements specified in
§5.3.
5.3

Personnel Controls

5.3.1 Background, Qualifications, Experience, and Clearance Requirements
The recruitment and selection practices for Starfield PKI personnel take into account thebackground, qualifications, experience, and clearance requirements of each position, which arecompared against the profiles of potential candidates.
5.3.2 Background Check Procedures
Background checks are performed prior to their commencement of employment with Starfield.
Such checks include identity verification and checks of character references, employment,
education and criminal record. Starfield employees are also required to complete a drug
screening.
Starfield employees are required to sign a nondisclosure agreement and are required to adhere toStarfield PKI policies and procedures.
5.3.3 Training Requirements
All Starfield PKI personnel receive on the job training covering:• Basic PKI concepts• This CP/CPS• Documented Starfield PKI security and operational policies and procedures• The use and operation of PKI system software.
• Common threats to the validation process including phishing and other social engineering
tactics
5.3.4 Retraining Frequency and Requirements
Starfield PKI personnel receive formal or informal training on the use of deployed PKI products
and Starfield PKI policies and procedures, upon hire and as necessary. Security awarenesscampaigns are ongoing.
5.3.5 Job Rotation Frequency and Sequence
No stipulation.

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

29

Starfield CP-CPS V2.5

5.3.6 Sanctions for Unauthorized Actions
In accordance with corporate polices, appropriate disciplinary actions will be taken for
unauthorized actions or other violations of Starfield PKI policies and procedures.
5.3.7 Contracting Personnel Requirements
Starfield PKI may employ contractors as necessary. Where contractors are used by the Starfield
PKI, they are subject to background check procedures comparable to those specified in §5.3.1
and 5.3.2.
5.3.8 Documentation Supplied to Personnel
Starfield PKI personnel are required to read this CP/CPS. They are also provided with Starfield
PKI policies, procedures, and other documentation relevant to their job functions.
6

Technical Security Controls

6.1

Key Pair Generation

6.1.1 Key Pair Generation
CA key pair generation uses cryptographic modules that meet the requirements of §6.2.1 andrequires the participation of multiple trusted employees.
Subscriber key pair generation is performed by the Subscriber.
6.1.2 Private Key Delivery to Entity
Starfield CA key pairs do not require delivery as they are generated and managed by the Starfield
PKI. As Subscriber key pairs are generated by the Subscriber, there is no private key
transportation requirement.
6.1.3 Public Key Delivery to Certificate Issuer
CA certificate requests are generated and processed by Starfield employees using a controlled
process that requires the participation of multiple trusted individuals. CA certificate requests are
PKCS #10 requests and accordingly contain the requesting CA’s public key and are digitally
signed by the requesting CA’s private key.
For Subscriber certificate requests, the Subscriber’s public key is submitted to the CA using acertificate request signed with the Subscriber’s private key. This mechanism ensures that:• the public key has not been modified during transit and• the sender possesses the private key corresponding to the transferred public key.
6.1.4 CA Public Key Delivery to Users
The Starfield Root CA is made available to Relying Parties through its inclusion in common
browser software.
Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

30

Starfield CP-CPS V2.5

The Starfield Root CA certificate may also be downloaded from the Starfield repository. A 160bit SHA-1 hash of the Starfield Root CA certificate is posted in the Starfield repository so thatusers may verify the authenticity of the Starfield Root CA certificate.
6.1.5 Key Sizes
Starfield CA key pairs are 1024 bit or higher RSA keys. Subscriber key pairs are 1024 bit or
higher RSA keys.
6.1.6 Public Key Parameters Generation and Quality Checking
Not applicable.
6.1.7 Hardware/Software Key Generation
Starfield CA key pairs are generated in and protected by hardware security modules certified to
FIPS 140-1 level 3.
Subscriber key pairs are generated and stored in hardware or software. It is recommended that
the Subscriber use a FIPS 140-1 certified cryptographic module for key generation.
6.1.8 Key Usage Purposes
Key pairs may be used as follows:
EntityRoot CAs
Issuing CAs
Subscriber

Permitted Key Usage
Signing of certificates for Subordinate CAs and other purposes as
required for the Starfield PKI and CRLs.
Signing of certificates for Subscribers and other purposes as required for
the Starfield PKI and CRLs.
Server authentication, digital signature, key encipherment, dataencryption.

The key usage extension is set in accordance with the certificate profile requirements specified in
§7.1.
6.2

CA Private Key Protection

6.2.1 Standards for Cryptographic Module
The Starfield PKI uses cryptographic modules that are certified to FIPS 140-1 Level 3 and meetindustry standards for random number and prime number generation.
6.2.2 Private Key Multi-Person Control
The Root CA is operated in offline mode. The participation of multiple trusted employees isrequired to perform sensitive CA private key operations (including hardware security module
Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

31

Starfield CP-CPS V2.5

(HSM) activation, Sub-CA certificate signing, CRL signing, CA key backup, and CA key
recovery). This is enforced by:• requiring 3 of 5 shareholders to present their assigned activation materials to activate thehardware security module• requiring 3 individuals to physically access the hardware security module• requiring 1 or more individuals with sufficient CA system privileges
The Issuing CA is operated in online mode. The participation of multiple trusted employees isrequired to perform sensitive CA private key operations (including HSM activation, CA key
backup, and CA key recovery). This is enforced by:• requiring 2 of 8 shareholders to present their assigned activation materials to activate thehardware security module• requiring 2 individuals to physically access the online HSM• requiring 3 individuals to physically access activation materials required (for CA key
backup and recovery)
6.2.3 Private Key Escrow
The escrow of CA and Subscriber private keys, for purposes of access by law enforcement or
any other reason, is not supported by the Starfield PKI.
6.2.4 Private Key Backup and Archival
Backup copies of CA private keys are stored in encrypted form using cryptographic modules thatmeet the requirements specified in §6.2.1.
Once a CA has reached the end of its maximum usage period as defined in § 6.3.2, HSMs
containing the CA private key will be securely destroyed
Subscriber private keys are not backed up or archived by the Starfield PKI.
6.2.5 Private Key Entry into Cryptographic Module
CA private keys are generated and used only within hardware cryptographic modules meeting
the requirements of §6.2.1. The private key exists outside hardware cryptographic modules only
in encrypted form.
6.2.6 Method of Activating Private Keys
Hardware modules used for CA private key protection utilize an activation mechanism as
described in §6.2.2.
Subscriber private keys should be protected with a pass phrase.
6.2.7 Method of Deactivating Private Key
CA private keys are de-activated by ending the session with the HSM device.

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

32

Starfield CP-CPS V2.5

6.2.8 Method of Destroying Private Key
CA private key destruction requires the participation of multiple trusted Starfield employees andapproval from Starfield management. When CA key destruction is required, CA private keys
will be completely destroyed through zeroization and/or physical destruction of the device inaccordance with manufacturers’ guidance.
6.3

Other Aspects of Key Pair Management

6.3.1 Public Key Archival
Copies of CA and Subscriber certificates are archived in accordance with §4.7.
6.3.2 Usage periods for the Public and Private Keys
For Starfield PKI CAs and Subscribers, key and certificate usage periods meet the following
requirements.
EntityMaximum Key
Usage Period (forcertificate signing)*
15 years
20 years
N/A

Root CAs
Issuing CAs
Subscribers

Maximum Key
Usage Period (forCRL signing)
20 years
25 years
N/A

Maximum
Certificate
Validity Period
30 years
20 years
10 years (ormaximum allowed
in applicableguidelines)* Maximum Key Usage Period does not apply to certificates that serve an infrastructure purpose,such as OCSP Responder certificates or Timestamp Authority certificates.
6.4

Activation Data

HSMs used for CA private key protection are configured to require multiple key shareholders as
described in §6.2.2. The activation materials are used only when needed and stored in a securesite when not in use.
6.5

Computer Security Controls

6.5.1 Specific Computer Security Technical Requirements
Starfield’s systems maintaining CA software and data files are secure from unauthorized access.
In addition, access to production servers is limited to those individuals with a valid businessreason for such access.
Starfield’s production network is separate from other components. This separation prevents
network access except through specific application processes. Starfield has sophisticated access
control technologies in place to protect the production network from unauthorized internal andexternal access and to limit network activities accessing production systems.
Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

33

Starfield CP-CPS V2.5

6.5.2 Computer Security Rating
No stipulation.
6.6

Life Cycle Technical Controls

6.6.1 System Development Controls
All CA software is developed in accordance with documented Starfield Software Development
Lifecycle processes. Approvals are required at all stages of development by the Starfield
Governance and Policy Authority Committee. All code is verified, using digital signatures andhashing, before being deployed into the production CA environment.
6.6.2 Security Management Controls
Starfield has tools and processes in place to control and monitor the configurations of the CA
systems. Starfield validates the integrity of all software before release into production.
6.6.3 Life Cycle Security Ratings
No stipulations
6.7

Network Security Controls

The Starfield network is secured through the use of preventative (properly configured routers andfirewalls) and detective controls (monitoring systems). Starfield performs all CA and RA
functions using networks secured in accordance with the Starfield Operations Guide to ensure
the systems are secure.
6.8

Cryptographic Module Engineering Controls

The Starfield PKI uses cryptographic modules that meet the requirements of §6.2.1.
7

Certificate and CRL Profiles

7.1

Certificate Profiles

7.1.1 Root CAs
The following certificate profile is used for the Starfield ValiCert Root CA.
Field
Version
Serial Number
Signature Algorithm Identifier
IssuerDescription
V1
1 (0x1)
sha1RSA (OID: 1.2.840.113549.1.1.5)
E = info@valicert.com
CN = http://www.valicert.com/
OU = ValiCert Class 2 Policy Validation Authority
O = ValiCert, Inc.
L = ValiCert Validation Network

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

34

Starfield CP-CPS V2.5

FieldValid From
Valid To
Subject

Subject Public Key Information

Description
June 26, 1999 00:19:54 GMT
June 26, 2019 00:19:54 GMT
E = info@valicert.com
CN = http://www.valicert.com/
OU = ValiCert Class 2 Policy Validation Authority
O = ValiCert, Inc.
L = ValiCert Validation Network
RSA (1024 bits)

The following certificate profile is used for the Starfield Class 2 Certification Authority.
Field
Version
Serial Number
Signature Algorithm Identifier
IssuerValid From
Valid To
Subject
Subject Public Key Information
Extensions:
Basic Constraints
Authority Key Identifier

Subject Key Identifier

Description
V3
0 (0x0)
sha1RSAOU=Starfield Class 2 Certification Authority
O=Starfield Technologies, Inc.
C=US
June 29, 2004 17:39:16 GMT
June 29, 2034 17:39:16 GMT
OU=Starfield Class 2 Certification Authority
O=Starfield Technologies, Inc.
C=US
RSA (2048 bits)
Subject Type=CA
Path Length Constraint=None
KeyID: bf 5f b7 d1 ce dd 1f 86 f4 5b 55 ac dc d7 10 c2 0e a9
88 e7
Certificate Issuer:
Directory Address:
OU=Starfield Class 2 Certification Authority
O=Starfield Technologies, Inc.
C=US
Certificate SerialNumber=00
bf 5f b7 d1 ce dd 1f 86 f4 5b 55 ac dc d7 10 c2 0e a9 88 e7

The following certificate profile is used for the Starfield Root Certificate Authority – G2.
Field
Version
Serial Number
Signature Algorithm Identifier

Description
V3
0 (0x0)sha256RSA

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

35

Starfield CP-CPS V2.5

FieldIssuerValid From
Valid To
Subject

Subject Public Key Information
Extensions:
Basic Constraints (critical)
Key Usage (critical)
Subject Key Identifier

Description
CN=Starfield Root Certificate Authority - G2
O=Starfield Technologies, Inc.
L=Scottsdale
S=Arizona
C=US
September 1, 2009 00:00:00 GMT
December 31, 2037 23:59:59 GMT
CN=Starfield Root Certificate Authority - G2
O=Starfield Technologies, Inc.
L=Scottsdale
S=Arizona
C=US
RSA (2048 bits)
Subject Type=CA
Path Length Constraint=None
keyCertSign, cRLSign7c 0c 32 1f a7 d9 30 7f c4 7d 68 a3 62 a8 a1 ce ab 07 5b 27

The following certificate profile is used for the Go Daddy Class 2 Certification Authority.
Field
Version
Serial Number
Signature Algorithm Identifier
IssuerValid From
Valid To
Subject
Subject Public Key Information
Extensions:
Basic Constraints
Authority Key Identifier

Description
V3
0 (0x0)
sha1RSAOU=Go Daddy Class 2 Certification Authority
O=The Go Daddy Group, Inc.
C=US
June 29, 2004 17:06:20 GMT
June 29, 2034 17:06:20 GMT
OU=Go Daddy Class 2 Certification Authority
O=The Go Daddy Group, Inc.
C=US
RSA (2048 bits)
Subject Type=CA
Path Length Constraint=None
KeyID=d2 c4 b0 d2 91 d4 4c 11 71 b3 61 cb 3d a1 fe dd a8
6a d4 e3
Certificate Issuer:
Directory Address:
OU=Go Daddy Class 2 Certification Authority
O=The Go Daddy Group, Inc.
C=US
Certificate SerialNumber=00

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

36

Starfield CP-CPS V2.5

FieldSubject Key Identifier

Description
d2 c4 b0 d2 91 d4 4c 11 71 b3 61 cb 3d a1 fe dd a8 6a d4 e3

The following certificate profile is used for the Go Daddy Root Certificate Authority – G2.
Field
Version
Serial Number
Signature Algorithm Identifier
IssuerValid From
Valid To
Subject

Subject Public Key Information
Extensions:
Basic Constraints (critical)
Key Usage (critical)
Subject Key Identifier

Description
V3
0 (0x0)sha256RSA
CN=Go Daddy Root Certificate Authority - G2
O=GoDaddy.com, Inc.
L=Scottsdale
S=Arizona
C=US
September 1, 2009 00:00:00 GMT
December 31, 2037 23:59:59 GMT
CN=Go Daddy Root Certificate Authority - G2
O=GoDaddy.com, Inc.
L=Scottsdale
S=Arizona
C=US
RSA (2048 bits)
Subject Type=CA
Path Length Constraint=None
keyCertSign, cRLSign3a 9a 85 07 10 67 28 b6 ef f6 bd 05 41 6e 20 c1 94 da 0f de

The following certificate profile is used for the Starfield Services Root Certification Authority.
Field
Version
Serial Number
Signature Algorithm Identifier
IssuerValid From
Valid To

Description
V3
0 (0x0)
sha1RSA
CN= Starfield Services Root Certification Authority
OU=http://certificates.starfieldtech.com/repository/
O=Starfield Technologies, Inc.
L=Scottsdale
ST=Arizona
C=US
June 2, 2008 00:00:00 GMT
December 31, 2029 23:59:59 GMT

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

37

Starfield CP-CPS V2.5

FieldSubject

Subject Public Key Information
Extensions:
Key Usage (critical)
Basic Constraints (critical)

Description
CN= Starfield Services Root Certification Authority
OU=http://certificates.starfieldtech.com/repository/
O=Starfield Technologies, Inc.
L=Scottsdale
ST=Arizona
C=US
RSA (2048 bits)

Authority Key Identifier

keyCertSign, cRLSign
Subject Type=CA
Path Length Constraint=Noneb4 c6 7f 1a 43 cc 9b 75 5d 2f c4 4b f2 8b 98 10 e9 f1 51 10

Subject Key Identifierb4 c6 7f 1a 43 cc 9b 75 5d 2f c4 4b f2 8b 98 10 e9 f1 51 10

The following certificate profile is used for the Starfield Services Root Certificate Authority –
G2.
Field
Version
Serial Number
Signature Algorithm Identifier
IssuerValid From
Valid To
Subject

Subject Public Key Information
Extensions:
Basic Constraints (critical)
Key Usage (critical)
Subject Key Identifier

Description
V3
0 (0x0)sha256RSA
CN=Starfield Services Root Certificate Authority - G2
O=Starfield Technologies, Inc.
L=Scottsdale
S=Arizona
C=US
September 1, 2009 00:00:00 GMT
December 31, 2037 23:59:59 GMT
CN=Starfield Services Root Certificate Authority - G2
O=Starfield Technologies, Inc.
L=Scottsdale
S=Arizona
C=US
RSA (2048 bits)
Subject Type=CA
Path Length Constraint=None
keyCertSign, cRLSign
9c 5f 00 df aa 01 d7 30 2b 38 88 a2 b8 6d 4a 9c f2 11 91 83

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

38

Starfield CP-CPS V2.5

7.1.2 Issuing CA
The following certificate profile is used for the Starfield Issuing CA.
Field
Version
Serial Number
Signature
Algorithm
Identifier
IssuerDescription
V3
260 (0x104)
sha1RSA (OID: 1.2.840.113549.1.1.5)

E = info@valicert.com
CN = http://www.valicert.com/
OU = ValiCert Class 2 Policy Validation Authority
O = ValiCert, Inc.
L = ValiCert Validation Network
Valid From
January 14, 2004 21:05:21 GMT
Valid To
January 9, 2024 21:05:21 GMT
Subject
E=practices@starfieldtech.com
CN = Starfield Secure Certification Authority
OU=http://www.starfieldtech.com/repository
O = Starfield Technologies, Inc.
L = Scottsdale
S = Arizona
C = US
Subject Public Key RSA (1024 bits)
Information
Extensions:
Key Usage
keyCertSign, cRLSign
Basic
Subject Type=CA
Constraints
Path Length Constraint=None
CRL
CRL Distribution Point
Distribution
Distribution Point Name:
PointsFull Name:
URL = http://certificates.starfieldtech.com/repository/root.crl
Certificate[1]Certificate Policy:
Policies
Policy Identifier=2.16.840.1.113733.1.7.23.3[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://www.starfieldtech.com/repository
Authority[1]Authority Info AccessInformation
Access Method=On-line Certificate Status Protocol
Access
(1.3.6.1.5.5.7.48.1)
Alternative Name:
URL=http://ocsp.starfieldtech.com
Subject Key
ac 55 de b7 ea 13 eb fc 98 68 e2 53 60 1e f1 25 3e 8c ee e7
Identifier
Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

39

Starfield CP-CPS V2.5

The following certificate profile is used for the Go Daddy 2048-bit Issuing CA.
Field
Version
Serial Number
Signature
Algorithm
Identifier
IssuerDescription
V3
769 (0x301)
sha1RSA (OID: 1.2.840.113549.1.1.5)

OU = Go Daddy Class 2 Certification Authority
O = The Go Daddy Group, Inc.
C = US
Valid From
November 16, 2006 01:54:37 GMT
Valid To
November 16, 2026 01:54:37 GMT
Subject
serialNumber = 07969287
CN = Go Daddy Secure Certification Authority
OU=http://certificates.godaddy.com/repository
O = GoDaddy.com, Inc.
L = Scottsdale
S = Arizona
C = US
Subject Public Key RSA (2048 bit) (OID: 1.2.840.113549.1.1.1)
Information
Extensions:
Key Usage
keyCertSign, cRLSign(critical)
Basic
Subject Type=CA
Constraints
Path Length Constraint=0(critical)
CRL
CRL Distribution Point
Distribution
Distribution Point Name:
PointsFull Name:
URL = http://certificates.godaddy.com/repository/gdroot.crl
Certificate[1]Certificate Policy:
Policies
Policy Identifier=anyPolicy (OID: 2 5 29 32 0)[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://certificates.godaddy.com/repository
Authority[1]Authority Info AccessInformation
Access Method=On-line Certificate Status Protocol
Access
(1.3.6.1.5.5.7.48.1)
Alternative Name:
URL=http://ocsp.godaddy.com
Authority Key
KeyID=d2 c4 b0 d2 91 d4 4c 11 71 b3 61 cb 3d a1 fe dd a8 6a d4 e3
Identifier
Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

40

Starfield CP-CPS V2.5

FieldSubject Key
Identifier

Description
fd ac 61 32 93 6c 45 d6 e2 ee 85 5f 9a ba e7 76 99 68 cc e7

The following certificate profile is used for the Starfield 2048-bit Issuing CA.
Field
Version
Serial Number
Signature
Algorithm
Identifier
IssuerValid From
Valid To
Subject

Subject Public
Key
Information
Extensions:
Key Usage(critical)
BasicConstraints(critical)
CRL
Distribution
PointsCertificate
Policies

Description
V3
513 (0x201)
sha1RSA (OID: 1.2.840.113549.1.1.5)
OU = Starfield Class 2 Certification Authority
O = Starfield Technologies, Inc.
C = US
November 16, 2006 01:15:40 GMT
November 16, 2026 01:15:40 GMT
serialNumber = 10688435
CN = Starfield Secure Certification Authority
OU=http://certificates.starfieldtech.com/repository
O = Starfield Technologies, Inc.
L = Scottsdale
S = Arizona
C = USRSA (2048 bit) (OID: 1.2.840.113549.1.1.1)

keyCertSign, cRLSign
Subject Type=CA
Path Length Constraint=0
CRL Distribution Point
Distribution Point Name:
Full Name:
URL = http://certificates.starfieldtech.com/repository/sfroot.crl[1]Certificate Policy:
Policy Identifier=anyPolicy (OID: 2 5 29 32 0)[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://certificates.starfieldtech.com/repository

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

41

Starfield CP-CPS V2.5

FieldAuthority
Information
AccessAuthority
Key
Identifier
Subject Key
Identifier

Description[1]Authority Info Access
Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)
Alternative Name:
URL=http://ocsp.starfieldtech.com
KeyID=bf 5f b7 d1 ce dd 1f 86 f4 5b 55 ac dc d7 10 c2 0e a9 88 e7
49 4b 52 27 d1 1b bc f2 a1 21 6a 62 7b 51 42 7a 8a d7 d5 56

7.1.3 Bridge CA Certificates
The following certificate profile is used for the certificate which cross certifies the Go Daddy
Class 2 Certification Authority with the ValiCert Class 2 Policy Validation Authority root.
Field
Version
Serial Number
Signature Algorithm Identifier
IssuerValid From
Valid To
Subject
Subject Public Key Information
Extensions:
Key Usage
Basic Constraints
CRL Distribution Points

Authority Information Access

Description
V3
269 (0x10D)
sha1RSA (OID: 1.2.840.113549.1.1.5)
E = info@valicert.com
CN = http://www.valicert.com/
OU = ValiCert Class 2 Policy Validation Authority
O = ValiCert, Inc.
L = ValiCert Validation Network
June 29, 2004 17:06:20 GMT
June 29, 2024 17:06:20 GMT
OU=Go Daddy Class 2 Certification Authority
O=The Go Daddy Group, Inc.
C=US
RSA (2048 bits)
keyCertSign, cRLSign
Subject Type=CA
Path Length Constraint=None
CRL Distribution Point
Distribution Point Name:
Full Name:
URL =http://certificates.godaddy.com/repository/root.crl[1]Authority Info Access
Access Method=On-line Certificate Status Protocol(1.3.6.1.5.5.7.48.1)
Alternative Name:
URL=http://ocsp.godaddy.com

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

42

Starfield CP-CPS V2.5

FieldCertificate Policies

Authority Key Identifier

Subject Key Identifier

Description[1]Certificate Policy:
Policy Identifier=anyPolicy (OID: 2 5 29 32 0)[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://certificates.godaddy.com/repository
Certificate Issuer:
Directory Address:
E = info@valicert.com
CN = http://www.valicert.com/
OU = ValiCert Class 2 Policy Validation Authority
O = ValiCert, Inc.
L = ValiCert Validation Network
Certificate SerialNumber=01
d2 c4 b0 d2 91 d4 4c 11 71 b3 61 cb 3d a1 fe dd a8 6a d4
e3

The following certificate profile is used for the certificate which cross certifies the Starfield
Class 2 Certification Authority with the ValiCert Class 2 Policy Validation Authority root.
Field
Description
Version
V3
Serial Number
268 (0x10C)
Signature Algorithm Identifier
sha1RSA (OID: 1.2.840.113549.1.1.5)
IssuerE = info@valicert.com
CN = http://www.valicert.com/
OU = ValiCert Class 2 Policy Validation Authority
O = ValiCert, Inc.
L = ValiCert Validation Network
Valid From
June 29, 2004 17:39:16 GMT
Valid To
June 29, 2024 17:39:16 GMT
Subject
OU=Starfield Class 2 Certification Authority
O=Starfield Technologies, Inc.
C=US
Subject Public Key Information
RSA (2048 bits)
Extensions:
Key Usage (critical)
keyCertSign, cRLSign
Basic Constraints (critical)
Subject Type=CA
Path Length Constraint=None
CRL Distribution Points
CRL Distribution Point
Distribution Point Name:
Full Name:
URL =http://certificates.starfieldtech.com/repository/root.crl
Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

43

Starfield CP-CPS V2.5

FieldAuthority Information AccessCertificate Policies

Authority Key Identifier

Subject Key Identifier

Description[1]Authority Info Access
Access Method=On-line Certificate Status Protocol(1.3.6.1.5.5.7.48.1)
Alternative Name:
URL=http://ocsp.starfieldtech.com[1]Certificate Policy:
Policy Identifier=anyPolicy (OID: 2 5 29 32 0)[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://certificates.starfieldtech.com/repository
Certificate Issuer:
Directory Address:
E = info@valicert.com
CN = http://www.valicert.com/
OU = ValiCert Class 2 Policy Validation Authority
O = ValiCert, Inc.
L = ValiCert Validation Network
Certificate SerialNumber=01
bf 5f b7 d1 ce dd 1f 86 f4 5b 55 ac dc d7 10 c2 0e a9 88
e7

7.1.4 End Entity SSL Certificates
The following certificate profile is used for Go Daddy branded Subscriber Certificates. At aminimum, the following fields will be populated as described, in accordance with IETF RFC
2459.
Field
Version
Serial Number
Signature Algorithm
Identifier
IssuerValid From
Valid To

Description
V3
unique value for each certificate issued by the Issuing CA
sha1RSA (OID: 1.2.840.113549.1.1.5)
serialNumber = 07969287
CN = Go Daddy Secure Certification Authority
OU=http://certificates.godaddy.com/repository
O = GoDaddy.com, Inc.
L = Scottsdale
S = Arizona
C = US
Date and time of Certificate issuance
One to ten years after Certificate issuance (depending on SSL certificatetype).

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

44

Starfield CP-CPS V2.5

FieldSubject (Medium
Assurance
Certificates

Subject (High
Assurance
Certificates

Subject (Extended
Validation
Certificates)

Subject Public Key
Information
Extensions:
Key Usage(critical)
BasicConstraints(critical)
Extended Key
Usage

Description
CN = domain name of Subscriber’s web site (may be fully qualified,wildcard, contain no periods, or IP address reserved for internal use)
OU = “Domain Control Verified” or similar text indicating the assurance
level of the certificate.
O = domain name of Subscriber’s web site (may be fully qualified,wildcard, contains no periods, or IP address reserved for internal use)
CN = domain name of Subscriber’s web site (may be fully qualified,wildcard, contains no periods, or IP address reserved for internal use)
OU = (if supplied in the subscriber's certificate request) The value of thefirst OU field requested by the customer. This data is not verified.
O = Subscriber’s organization or individual name
L = City/town
S = State
C = Country
serialNumber= Registration number assigned by incorporating authority
or date of incorporation or registration
jurisdictionOfIncorporationCountryName= Country of incorporation orregistration
jurisdictionOfIncorporationStateOrProvinceName= State ofincorporation or registration (if applicable)
jurisdictionOfIncorporationLocalityName= City/town of incorporation orregistration (if applicable)businessCategory=vetting category used to issue certificate as defined in
the CA/Browser Forum Guidelines for the Issuance and Management ofExtended Validation Certificates
CN = domain name of Subscriber’s web site
O = Subscriber’s full legal organization name. An assumed name or
DBA may also be included
L = City/town of place of businessS = State of place of business
C = Country of place of business
RSA (1024 bits or higher. 2048 bits or higher for Extended Validation
certificates)
Digital Signature, Key Encipherment(A0)Subject Type=End Entity
Path Length Constraint=None
Server Authentication (1.3.6.1.5.5.7.3.1)
Client Authentication (1.3.6.1.5.5.7.3.2)

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

45

Starfield CP-CPS V2.5

FieldCRL
Distribution
PointsCertificate
Policies(Medium
Assurance
Certificates)
Certificate
Policies (High
Assurance
Certificates)
Certificate
Policies(Extended
Validation
Certificates)
Authority
Information
AccessSubject
Alternative
Name

Description
CRL Distribution Point
Distribution Point Name:
Full Name:
URL = <current CRL URI>
The specific URI will vary depending on certificate type and CRL scope.
[1]Certificate Policy:
Policy Identifier=2.16.840.1.114413.1.7.23.1[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://certificates.godaddy.com/repository[1]Certificate Policy:
Policy Identifier=2.16.840.1.114413.1.7.23.2[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://certificates.godaddy.com/repository[1]Certificate Policy:
Policy Identifier=2.16.840.1.114413.1.7.23.3[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://certificates.godaddy.com/repository[1]Authority Info Access
Access Method=On-line Certificate Status Protocol(1.3.6.1.5.5.7.48.1)
Alternative Name:
URL=http://ocsp.godaddy.com[2] Authority Info Access
Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)
Alternative Name:
URL=http://certificates.godaddy.com/repository/gd_intermediate.crt
Optional. If included, set to:
1. DNS=fully qualified domain name of the Subscriber’s site,domain name remaining after removing “www.” From the left
hand portion of the fully qualified domain name.
And/or:
2. DNS=fully qualified domain name of Subscriber’s site, fully
qualified domain name of additional sites which have undergone
the following verification step as part of the authentication
process: the individual requesting the certificate has access to thedomain name(s) that are specified in the certificate application

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

46

Starfield CP-CPS V2.5

The following certificate profile is used for Starfield branded Subscriber Certificates. At aminimum, the following fields will be populated as described, in accordance with IETF RFC
2459.
Field
Version
Serial Number
Signature Algorithm
Identifier
IssuerValid From
Valid To
Subject (Medium
Assurance
Certificates

Subject (High
Assurance
Certificates

Description
V3
unique value for each certificate issued by the Issuing CA
sha1RSA (OID: 1.2.840.113549.1.1.5)
serialNumber = 10688435
CN = Starfield Secure Certification Authority
OU=http://certificates.starfieldtech.com/repository
O = Starfield Technologies, Inc.
L = Scottsdale
S = Arizona
C = US
Date and time of Certificate issuance
One to ten years after Certificate issuance (depending on SSL certificatetype).
CN = domain name of Subscriber’s web site (may be fully qualified,wildcard, contain no periods, or IP address reserved for internal use)
OU = “Domain Control Verified” or similar text indicating the assurance
level of the certificate.
O = domain name of Subscriber’s web site (may be fully qualified,wildcard, contain no periods, or IP address reserved for internal use)
CN = domain name of Subscriber’s web site (may be fully qualified,wildcard, contain no periods, or IP address reserved for internal use)
OU = (if supplied in the subscriber's certificate request) The value of thefirst OU field requested by the customer. This data is not verified.
O = Subscriber’s organization or individual name
L = City/town
S = State
C = Country

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

47

Starfield CP-CPS V2.5

FieldSubject (Extended
Validation
Certificates)

Subject Public Key
Information
Extensions:
Key Usage(critical)
BasicConstraints(critical)
Extended Key
Usage
CRL
Distribution
PointsCertificate
Policies(Medium
Assurance
Certificates)
Certificate
Policies (High
Assurance
Certificates)
Certificate
Policies

Description
serialNumber= Registration number assigned by incorporating authority
or date of incorporation or registration
jurisdictionOfIncorporationCountryName= Country of incorporation
jurisdictionOfIncorporationStateOrProvinceName= State ofincorporation (if applicable)
jurisdictionOfIncorporationLocalityName= City/town of incorporation (ifapplicable)businessCategory=vetting category used to issue certificate as defined in
the CA/Browser Forum Guidelines for the Issuance and Management ofExtended Validation Certificates
CN = domain name of Subscriber’s web site
O = Subscriber’s full legal organization name. An assumed name or
DBA may also be included
L = City/town of place of businessS = State of place of business
C = Country of place of business
RSA (1024 bits or higher. 2048 bits or higher for Extended Validation
certificates)
Digital Signature, Key Encipherment(A0)Subject Type=End Entity
Path Length Constraint=None
Server Authentication (1.3.6.1.5.5.7.3.1)
Client Authentication (1.3.6.1.5.5.7.3.2)
CRL Distribution Point
Distribution Point Name:
Full Name:
URL =<current CRL URI>
The specific URI will vary depending on certificate type and CRL scope.
[1]Certificate Policy:
Policy Identifier=2.16.840.1.114414.1.7.23.1[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://certificates.starfieldtech.com/repository[1]Certificate Policy:
Policy Identifier=2.16.840.1.114414.1.7.23.2[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://certificates.starfieldtech.com/repository[1]Certificate Policy:
Policy Identifier=2.16.840.1.114414.1.7.23.3

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

48

Starfield CP-CPS V2.5

Field(Extended
Validation
Certificates)
Authority
Information
AccessSubject
Alternative
Name

Description[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://certificates.starfieldtech.com/repository[1]Authority Info Access
Access Method=On-line Certificate Status Protocol(1.3.6.1.5.5.7.48.1)
Alternative Name:
URL=http://ocsp.starfieldtech.com[2] Authority Info Access
Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)
Alternative Name:
URL=http://certificates.starfieldtech.com/repository/sf_intermediate.crt
Optional. If included, set to:
1. DNS=fully qualified domain name of the Subscriber’s site,domain name remaining after removing “www.” From the left
hand portion of the fully qualified domain name.
And/or:
2. DNS=fully qualified domain name of Subscriber’s site, fully
qualified domain name of additional sites which have undergone
the following verification step as part of the authentication
process: the individual requesting the certificate has access to thedomain name(s) that are specified in the certificate application

7.1.5 End Entity Code Signing Certificates
The following certificate profile is used for Go Daddy branded Subscriber Certificates. At aminimum, the following fields will be populated as described, in accordance with IETF RFC
2459.
Field
Version
Serial Number
Signature Algorithm
Identifier
IssuerValid From
Valid To

Description
V3
unique value for each certificate issued by the Issuing CA
sha1RSA (OID: 1.2.840.113549.1.1.5)
serialNumber = 07969287
CN = Go Daddy Secure Certification Authority
OU=http://certificates.godaddy.com/repository
O = GoDaddy.com, Inc.
L = Scottsdale
S = Arizona
C = US
Date and time of Certificate issuance
One to three years after Certificate issuance

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

49

Starfield CP-CPS V2.5

FieldSubject

Subject Public Key
Information
Extensions:
Key Usage(critical)
Basic Constraints(critical)
Extended Key Usage
Subject Key
Identifier
Authority Key
Identifier
CRL Distribution
PointsCertificate Policies

Authority
Information Access

Description
CN = Subscriber's organization name
OU = (if supplied in the subscriber's certificate request) The value of thefirst OU field requested by the customer. This data is not verified.
O = Subscriber’s organization name
L = City/town
S = State
C = Country
RSA (1024 bits or higher)
Digital Signature, Key Encipherment
Subject Type=End Entity
Path Length Constraint=None
Code Signing (1.3.6.1.5.5.7.3.3) (all Code Signing certificates)
160-bit SHA1 hash of the public key contained within this certificate
160-bit SHA1 hash of the public key of the issuing certificate authority
CRL Distribution Point
Distribution Point Name:
Full Name:
URL = <current CRL URI>
The specific URI will vary depending on certificate type and CRL scope.
[1]Certificate Policy:
Policy Identifier=2.16.840.1.114413.1.7.23.2[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://certificates.godaddy.com/repository[1]Authority Info Access
Access Method=On-line Certificate Status Protocol(1.3.6.1.5.5.7.48.1)
Alternative Name:
URL=http://ocsp.godaddy.com[2] Authority Info Access
Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)
Alternative Name:
URL=http://certificates.godaddy.com/repository/gd_intermediate.crt

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

50

Starfield CP-CPS V2.5

The following certificate profile is used for Starfield branded Subscriber Certificates. At aminimum, the following fields will be populated as described, in accordance with IETF RFC
2459.
Field
Version
Serial Number
Signature Algorithm
Identifier
IssuerValid From
Valid To
Subject

Subject Public Key
Information
Extensions:
Key Usage(critical)
Basic Constraints(critical)
Extended Key Usage
Subject Key
Identifier
Authority Key
Identifier
CRL Distribution
PointsDescription
V3
unique value for each certificate issued by the Issuing CA
sha1RSA (OID: 1.2.840.113549.1.1.5)
serialNumber = 10688435
CN = Starfield Secure Certification Authority
OU=http://certificates.starfieldtech.com/repository
O = Starfield Technologies, Inc.
L = Scottsdale
S = Arizona
C = US
Date and time of Certificate issuance
One to three years after Certificate issuance
CN = Subscriber's organization name
OU = (if supplied in the subscriber's certificate request) The value of thefirst OU field requested by the customer. This data is not verified.
O = Subscriber’s organization name
L = City/town
S = State
C = Country
RSA (1024 bits or higher)
Digital Signature, Key Encipherment
Subject Type=End Entity
Path Length Constraint=None
Code Signing (1.3.6.1.5.5.7.3.3) (all Code Signing certificates)
160-bit SHA1 hash of the public key contained within this certificate
160-bit SHA1 hash of the public key of the issuing certificate authority
CRL Distribution Point
Distribution Point Name:
Full Name:
URL = <current CRL URI>
The specific URI will vary depending on certificate type and CRL scope.

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

51

Starfield CP-CPS V2.5

FieldCertificate Policies(High Assurance
Certificates)

Authority
Information Access

Description[1]Certificate Policy:
Policy Identifier=2.16.840.1.114414.1.7.23.2[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://certificates.starfieldtech.com/repository[1]Authority Info Access
Access Method=On-line Certificate Status Protocol(1.3.6.1.5.5.7.48.1)
Alternative Name:
URL=http://ocsp.starfieldtech.com[2] Authority Info Access
Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)
Alternative Name:
URL=http://certificates.starfieldtech.com/repository/sf_intermediate.crt

7.1.6 End Entity Custom Certificates
The Starfield PKI reserves the right to issue certificates specialized for particular purposes orapplications. These certificates may not conform to any established standard or RFC, but are
rather intended for use in custom applications. Each such custom certificate profile will carry aunique policy OID in the Certificate Policies extension that will map to a custom certificate
profile listed in this section.
7.1.6.1 Custom Certificate Profile Type 1
The following certificate profile is used for Go Daddy branded Subscriber Certificates.
Field
Version
Serial Number
Signature Algorithm
Identifier
IssuerValid From
Valid To
Subject

Description
V3
unique value for each certificate issued by the Issuing CA
sha1RSA (OID: 1.2.840.113549.1.1.5)
serialNumber = 07969287
CN = Go Daddy Secure Certification Authority
OU=http://certificates.godaddy.com/repository
O = GoDaddy.com, Inc.
L = Scottsdale
S = Arizona
C = US
Date and time of Certificate issuance
Up to 5 years after Certificate issuance
Empty DER SEQUENCE

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

52

Starfield CP-CPS V2.5

FieldSubject Public Key
Information
Extensions:
Key Usage(critical)
Basic Constraints(critical)
Extended Key Usage(critical)
Subject Key
Identifier
Authority Key
Identifier
CRL Distribution
PointsCertificate Policies

Authority
Information AccessSubject Alternative
Name(critical)

Description
RSA (2048 bits or higher)
Digital Signature, Key Encipherment
Subject Type=End Entity
Path Length Constraint=None
1.3.6.1.4.1.33161.1.1
Server Authentication (1.3.6.1.5.5.7.3.1)
Client Authentication (1.3.6.1.5.5.7.3.2)
160-bit SHA1 hash of the public key contained within this certificate
160-bit SHA1 hash of the public key of the issuing certificate authority
CRL Distribution Point
Distribution Point Name:
Full Name:
URL = <current CRL URI>
The specific URI will vary depending on certificate type and CRL scope.
[1]Certificate Policy:
Policy Identifier=2.16.840.1.114413.1.7.23.5[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://certificates.godaddy.com/repository/[1]Authority Info Access
Access Method=On-line Certificate Status Protocol(1.3.6.1.5.5.7.48.1)
Alternative Name:
URL=http://ocsp.godaddy.com[2] Authority Info Access
Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)
Alternative Name:
URL=http://certificates.godaddy.com/repository/gd_intermediate.crt
One or more uniformResourceIdentifier values

The following certificate profile is used for Starfield branded Subscriber Certificates.
Field
Version
Serial Number

Description
V3
unique value for each certificate issued by the Issuing CA

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

53

Starfield CP-CPS V2.5

FieldSignature Algorithm
Identifier
IssuerValid From
Valid To
Subject
Subject Public Key
Information
Extensions:
Key Usage(critical)
Basic Constraints(critical)
Extended Key Usage(critical)
Subject Key
Identifier
Authority Key
Identifier
CRL Distribution
PointsCertificate Policies

Authority
Information Access

Description
sha1RSA (OID: 1.2.840.113549.1.1.5)
serialNumber = 10688435
CN = Starfield Secure Certification Authority
OU=http://certificates.starfieldtech.com/repository
O = Starfield Technologies, Inc.
L = Scottsdale
S = Arizona
C = US
Date and time of Certificate issuance
Up to 5 years after Certificate issuance
Empty DER SEQUENCERSA (2048 bits or higher)
Digital Signature, Key Encipherment
Subject Type=End Entity
Path Length Constraint=None
1.3.6.1.4.1.33161.1.1
Server Authentication (1.3.6.1.5.5.7.3.1)
Client Authentication (1.3.6.1.5.5.7.3.2)
160-bit SHA1 hash of the public key contained within this certificate
160-bit SHA1 hash of the public key of the issuing certificate authority
CRL Distribution Point
Distribution Point Name:
Full Name:
URL = <current CRL URI>
The specific URI will vary depending on certificate type and CRL scope.
[1]Certificate Policy:
Policy Identifier=2.16.840.1.114414.1.7.23.5[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://certificates.starfieldtech.com/repository/[1]Authority Info Access
Access Method=On-line Certificate Status Protocol(1.3.6.1.5.5.7.48.1)
Alternative Name:
URL=http://ocsp.starfieldtech.com[2] Authority Info Access
Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

54

Starfield CP-CPS V2.5

FieldSubject Alternative
Name(critical)
7.2

Description
Alternative Name:
URL=http://certificates.starfieldtech.com/repository/sf_intermediate.
crt
One or more uniformResourceIdentifier values

CRL Profiles

CRLs MAY be either V1 or V2. When a V2 CRL is issued, additional fields may be present asshown in the tables below.
7.2.1 Root CAs
The following CRL profile is used for the Starfield Root CA.
Field
VersionSignature
IssuerThis Update (Effective Date)
Next Update
CRL extensions (V2 only)
CRL Number
Revoked Certificates

Description
V1 or V2 (0x1)
sha1RSA (OID: 1.2.840.113549.1.1.5)
E = info@valicert.com
CN = http://www.valicert.com/
OU = ValiCert Class 2 Policy Validation Authority
O = ValiCert, Inc.
L = ValiCert Validation Network
Date and time of CRL issuance.
365 days after This Update.
Unique value for each CRL issued by the Starfield RootCA
List of information regarding revoked certificates. CRL
entries include:• Serial Number, identifying the revoked certificate• Revocation Date, including the date and time ofcertificate revocation

CRL Entry Extensions (V2 only
and optional for any given CRL
entry)

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

55

Starfield CP-CPS V2.5

FieldCRL Reason CodeInvalidity Date

Description
One of the following reason codes:
unspecified
keyCompromise
cACompromise
affiliationChanged
superseded
cessationOfOperation
certificateHold
removeFromCRL
privilegeWithdrawn
aACompromise

(0)
(1)
(2)
(3)
(4)
(5)
(6)
(8)
(9)
(10)

A GeneralizedTime denoting the effective time when thegiven serial number is to be considered invalid.

The following CRL profile is used for the Starfield Class 2 Certification Authority Root CA.
Field
VersionSignature
IssuerThis Update (Effective Date)
Next Update
CRL extensions (V2 only)
CRL Number
Authority Key Identifier
Revoked Certificates

CRL Entry Extensions (V2 only
and optional for any given CRL
entry)CRL Reason CodeDescription
V1 or V2 (0x1)
sha1RSA (OID: 1.2.840.113549.1.1.5)
OU=Starfield Class 2 Certification Authority
O=Starfield Technologies, Inc.
C=US
Date and time of CRL issuance.
365 days after This Update.
Unique value for each CRL issued by the Starfield Class 2
Root CAbf 5f b7 d1 ce dd 1f 86 f4 5b 55 ac dc d7 10 c2 0e a9 88
e7
List of information regarding revoked certificates. CRL
entries include:• Serial Number, identifying the revoked certificate• Revocation Date, including the date and time ofcertificate revocation

One of the following reason codes:
unspecified
keyCompromise
cACompromise
affiliationChanged
superseded
cessationOfOperation
certificateHold
removeFromCRL
privilegeWithdrawn
aACompromise

(0)
(1)
(2)
(3)
(4)
(5)
(6)
(8)
(9)
(10)

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

56

Starfield CP-CPS V2.5

FieldInvalidity Date

Description
A GeneralizedTime denoting the effective time when thegiven serial number is to be considered invalid.

The following CRL profile is used for the Starfield Root Certificate Authority - G2.
Field
VersionSignature
IssuerThis Update (Effective Date)
Next Update
CRL extensions (V2 only)
CRL Number
Authority Key Identifier
Revoked Certificates

CRL Entry Extensions (V2 only
and optional for any given CRL
entry)CRL Reason CodeDescription
V1 or V2 (0x1)
sha256RSA (OID: 1.2.840.113549.1.1.11)
CN=Starfield Root Certificate Authority - G2
O=Starfield Technologies, Inc.
L=Scottsdale
S=Arizona
C=US
Date and time of CRL issuance.
365 days after This Update.
Unique value for each CRL issued by the Starfield Root
Certificate Authority - G2
7c 0c 32 1f a7 d9 30 7f c4 7d 68 a3 62 a8 a1 ce ab 07 5b
27
List of information regarding revoked certificates. CRL
entries include:• Serial Number, identifying the revoked certificate• Revocation Date, including the date and time ofcertificate revocation

One of the following reason codes:
unspecified
keyCompromise
cACompromise
affiliationChanged
superseded
cessationOfOperation
certificateHold
removeFromCRL
privilegeWithdrawn
aACompromise

Invalidity Date

(0)
(1)
(2)
(3)
(4)
(5)
(6)
(8)
(9)
(10)

A GeneralizedTime denoting the effective time when thegiven serial number is to be considered invalid.

The following CRL profile is used for the Go Daddy Class 2 Root CA.
Field
VersionSignature

Description
V1 or V2 (0x1)
sha1RSA (OID: 1.2.840.113549.1.1.5)
Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

57

Starfield CP-CPS V2.5

FieldIssuerThis Update (Effective Date)
Next Update
CRL extensions (V2 only)
CRL Number
Authority Key Identifier
Revoked Certificates

CRL Entry Extensions (V2 only
and optional for any given CRL
entry)CRL Reason CodeDescription
OU=Go Daddy Class 2 Certification Authority
O=The Go Daddy Group, Inc.
C=US
Date and time of CRL issuance.
365 days after This Update.
Unique value for each CRL issued by the Go Daddy Class
2 Root CA
d2 c4 b0 d2 91 d4 4c 11 71 b3 61 cb 3d a1 fe dd a8 6a d4
e3
List of information regarding revoked certificates. CRL
entries include:• Serial Number, identifying the revoked certificate• Revocation Date, including the date and time ofcertificate revocation

One of the following reason codes:
unspecified
keyCompromise
cACompromise
affiliationChanged
superseded
cessationOfOperation
certificateHold
removeFromCRL
privilegeWithdrawn
aACompromise

Invalidity Date

(0)
(1)
(2)
(3)
(4)
(5)
(6)
(8)
(9)
(10)

A GeneralizedTime denoting the effective time when thegiven serial number is to be considered invalid.

The following CRL profile is used for the Go Daddy Root Certificate Authority - G2.
Field
VersionSignature
IssuerThis Update (Effective Date)
Next Update
CRL extensions (V2 only)
CRL Number

Description
V1 or V2 (0x1)
sha256RSA (OID: 1.2.840.113549.1.1.11)
CN=Go Daddy Root Certificate Authority - G2
O=GoDaddy.com, Inc.
L=Scottsdale
S=Arizona
C=US
Date and time of CRL issuance.
365 days after This Update.
Unique value for each CRL issued by the Go Daddy Root
Certificate Authority - G2

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

58

Starfield CP-CPS V2.5

FieldAuthority Key Identifier
Revoked Certificates

CRL Entry Extensions (V2 only
and optional for any given CRL
entry)CRL Reason CodeDescription
3a 9a 85 07 10 67 28 b6 ef f6 bd 05 41 6e 20 c1 94 da 0f
deList of information regarding revoked certificates. CRL
entries include:• Serial Number, identifying the revoked certificate• Revocation Date, including the date and time ofcertificate revocation

One of the following reason codes:
unspecified
keyCompromise
cACompromise
affiliationChanged
superseded
cessationOfOperation
certificateHold
removeFromCRL
privilegeWithdrawn
aACompromise

Invalidity Date

(0)
(1)
(2)
(3)
(4)
(5)
(6)
(8)
(9)
(10)

A GeneralizedTime denoting the effective time when thegiven serial number is to be considered invalid.

The following CRL profile is used for the Starfield Services Root CA.
Field
VersionSignature
IssuerThis Update (Effective Date)
Next Update
CRL extensions (V2 only)
CRL Number
Authority Key Identifier
Revoked Certificates

Description
V1 or V2 (0x1)
sha1RSA (OID: 1.2.840.113549.1.1.5)
CN= Starfield Services Root Certification Authority
OU=http://certificates.starfieldtech.com/repository/
O=Starfield Technologies, Inc.
L=Scottsdale
ST=Arizona
C=US
Date and time of CRL issuance.
365 days after This Update.
Unique value for each CRL issued by the Starfield
Services Root CA
b4 c6 7f 1a 43 cc 9b 75 5d 2f c4 4b f2 8b 98 10 e9 f1 51
10
List of information regarding revoked certificates. CRL
entries include:• Serial Number, identifying the revoked certificate• Revocation Date, including the date and time ofcertificate revocation

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

59

Starfield CP-CPS V2.5

FieldCRL Entry Extensions (V2 only
and optional for any given CRL
entry)CRL Reason CodeDescription

One of the following reason codes:
unspecified
keyCompromise
cACompromise
affiliationChanged
superseded
cessationOfOperation
certificateHold
removeFromCRL
privilegeWithdrawn
aACompromise

Invalidity Date

(0)
(1)
(2)
(3)
(4)
(5)
(6)
(8)
(9)
(10)

A GeneralizedTime denoting the effective time when thegiven serial number is to be considered invalid.

The following CRL profile is used for the Starfield Services Root Certificate Authority - G2.
Field
VersionSignature
IssuerThis Update (Effective Date)
Next Update
CRL extensions (V2 only)
CRL Number
Authority Key Identifier
Revoked Certificates

Description
V1 or V2 (0x1)
sha256RSA (OID: 1.2.840.113549.1.1.11)
CN=Starfield Services Root Certificate Authority - G2
O=Starfield Technologies, Inc.
L=Scottsdale
S=Arizona
C=US
Date and time of CRL issuance.
365 days after This Update.
Unique value for each CRL issued by the Starfield
Services Root Certificate Authority - G2
9c 5f 00 df aa 01 d7 30 2b 38 88 a2 b8 6d 4a 9c f2 11 91
83
List of information regarding revoked certificates. CRL
entries include:• Serial Number, identifying the revoked certificate• Revocation Date, including the date and time ofcertificate revocation

CRL Entry Extensions (V2 only
and optional for any given CRL
entry)

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

60

Starfield CP-CPS V2.5

FieldCRL Reason CodeDescription
One of the following reason codes:
unspecified
keyCompromise
cACompromise
affiliationChanged
superseded
cessationOfOperation
certificateHold
removeFromCRL
privilegeWithdrawn
aACompromise

Invalidity Date

(0)
(1)
(2)
(3)
(4)
(5)
(6)
(8)
(9)
(10)

A GeneralizedTime denoting the effective time when thegiven serial number is to be considered invalid.

7.2.2 Issuing CAs
The following CRL profile is used for the Starfield Issuing CA.
Field
VersionSignature
IssuerThis Update (Effective Date)
Next Update
CRL extensions (V2 only)
CRL Number
Authority Key Identifier
Revoked Certificates

Description
V1 or V2 (0x1)
sha1RSA (OID: 1.2.840.113549.1.1.5)
E=practices@starfieldtech.com
CN = Starfield Secure Certification Authority
OU=http://www.starfieldtech.com/repository
O = Starfield Technologies, Inc.
L = Scottsdale
S = Arizona
C = US
Date and time of CRL issuance.
No greater than 7 days after This Update.
Unique value for each CRL issued by the Starfield IssuingCA
ac 55 de b7 ea 13 eb fc 98 68 e2 53 60 1e f1 25 3e 8c eee7
List of information regarding revoked certificates. CRL
entries include:• Serial Number, identifying the revoked certificate• Revocation Date, including the date and time ofcertificate revocation

CRL Entry Extensions (V2 only
and optional for any given CRL
entry)

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

61

Starfield CP-CPS V2.5

FieldCRL Reason CodeDescription
One of the following reason codes:
unspecified
keyCompromise
cACompromise
affiliationChanged
superseded
cessationOfOperation
certificateHold
removeFromCRL
privilegeWithdrawn
aACompromise

Invalidity Date

(0)
(1)
(2)
(3)
(4)
(5)
(6)
(8)
(9)
(10)

A GeneralizedTime denoting the effective time when thegiven serial number is to be considered invalid.

The following CRL profile is used for the Starfield 2048-bit Issuing CA.
Field
VersionSignature
IssuerThis Update (Effective Date)
Next Update
CRL extensions (V2 only)
CRL Number
Authority Key Identifier
Revoked Certificates

Description
V1 or V2 (0x1)
sha1RSA (OID: 1.2.840.113549.1.1.5)
serialNumber (OID 2.5.4.5) = 10688435
CN = Starfield Secure Certification Authority
OU=http://certificates.starfieldtech.com/repository
O = Starfield Technologies, Inc.
L (OID 2.5.4.7) = Scottsdale
S (OID 2.5.4.8) = Arizona
C (OID 2.5.4.6) = US
Date and time of CRL issuance.
No greater than 7 days after This Update.
Unique value for each CRL issued by the Starfield 2048bit Issuing CA
49 4b 52 27 d1 1b bc f2 a1 21 6a 62 7b 51 42 7a 8a d7 d556
List of information regarding revoked certificates. CRL
entries include:• Serial Number, identifying the revoked certificate• Revocation Date, including the date and time ofcertificate revocation

CRL Entry Extensions (V2 only
and optional for any given CRL
entry)

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

62

Starfield CP-CPS V2.5

FieldCRL Reason CodeDescription
One of the following reason codes:
unspecified
keyCompromise
cACompromise
affiliationChanged
superseded
cessationOfOperation
certificateHold
removeFromCRL
privilegeWithdrawn
aACompromise

Invalidity Date

(0)
(1)
(2)
(3)
(4)
(5)
(6)
(8)
(9)
(10)

A GeneralizedTime denoting the effective time when thegiven serial number is to be considered invalid.

The following CRL profile is used for the Go Daddy 2048-bit Issuing CA.
Field
VersionSignature
IssuerThis Update (Effective Date)
Next Update
CRL extensions (V2 only)
CRL Number
Authority Key Identifier
Revoked Certificates

Description
V1 or V2 (0x1)
sha1RSA (OID: 1.2.840.113549.1.1.5)
serialNumber (OID 2.5.4.5) = 07969287
CN = Go Daddy Secure Certification Authority
OU=http://certificates.godaddy.com/repository
O = GoDaddy.com, Inc.
L (OID 2.5.4.7) = Scottsdale
S (OID 2.5.4.8) = Arizona
C (OID 2.5.4.6) = US
Date and time of CRL issuance.
No greater than 7 days after This Update.
Unique value for each CRL issued by the Go Daddy
2048-bit Issuing CA
fd ac 61 32 93 6c 45 d6 e2 ee 85 5f 9a ba e7 76 99 68 cc
e7
List of information regarding revoked certificates. CRL
entries include:• Serial Number, identifying the revoked certificate• Revocation Date, including the date and time ofcertificate revocation

CRL Entry Extensions (V2 only
and optional for any given CRL
entry)

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

63

Starfield CP-CPS V2.5

FieldCRL Reason CodeDescription
One of the following reason codes:
unspecified
keyCompromise
cACompromise
affiliationChanged
superseded
cessationOfOperation
certificateHold
removeFromCRL
privilegeWithdrawn
aACompromise

Invalidity Date

(0)
(1)
(2)
(3)
(4)
(5)
(6)
(8)
(9)
(10)

A GeneralizedTime denoting the effective time when thegiven serial number is to be considered invalid.

8

Specification Administration

8.1

Specification Change Procedures

Modifications to this CP/CPS are approved by the Starfield Governance and Policy Committee
and become effective upon publication in the Starfield repository.
8.2

Publication and Notification Policies

This CP/CPS and subsequent revisions are published in the Starfield repository in accordancewith §2.6.1. Starfield may change this document at any time without prior notice.
8.3

CPS Approval Procedures

See §8.1.
9Definitions•

Certificate - digital record that contains information such as the Subscriber’s
distinguished name and public key, and the signer's signature and data•

Certificate Revocation List (CRL) – periodically published listing of all certificates thathave been revoked for use by Relying Parties•

Certificate Signing Request (CSR) – a message sent to the certification authority
containing the information required to issue a digital certificate•

Certification Authority (CA) – see section 1.3.1•

Code Signing Certificate – a certificate issued to an organization for the purpose ofdigitally signing software•

Compromise - a loss, theft, disclosure, modification, unauthorized use, or other breach of
security related to a Private Key•

Custom Certificate – a certificate profile defined for a specific, non-standard usage•

Distinguished Name (DN) – a globally unique identifier representing a Subscriber
Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

64

Starfield CP-CPS V2.5

•

Extended Validation (EV) – certificate issued under the Guidelines for the Issuance andManagement of Extended Validation Certificates published by the CA/Browser Forum(http://www.cabforum.org)•

Governance and Policy Authority Committee (GPAC) – the Starfield committee which
creates and maintains the policies related to the Starfield Public Key Infrastructure. Also
known as the Policy Authority Committee (PAC)•

Hardware Security Module (HSM) –a specialized computer hardware system designed tosecurely store encryption keys•

High Assurance – Starfield’s vetting process that verifies the identity of the individual ororganization that requested the certificate and access to the domain•

Medium Assurance – Starfield’s vetting process that verifies access to the domain•

Policy Authority Committee – See Governance and Policy Authority Committee•

Private Key – a confidential encrypted electronic data file that interfaces with a Public
Key using the same encryption algorithm, in order to verify Digital Signatures andencrypt files or messages•

Public Key – an encrypted electronic data file that is publicly available for interfacingwith a Private Key•

Registration Authority (RA) – see section 1.3.2•

Relying Party – an individual or entity that acts in reliance on a Certificate or digital
signature associated with a Certificate•

Relying Party Agreement – an agreement which specifies the stipulations under which aperson or organization acts as a Relying Party•

Reseller – a person or organization which is given permission by Starfield to sell products
to Subscribers•

Starfield – Starfield Technologies, Inc., and its resellers•

Starfield PKI - the Starfield Public Key Infrastructure that provides Certificates forindividuals and entities.

•

Subscriber – the individual or entity that has been issued a Certificate and is authorized touse the Private Key that corresponds to the Public Key in the Certificate•

Subscriber Agreement – an agreement which specifies the stipulations under which aperson or organization acts as a Subscriber•

Unified Communications Certificate (UCC) – certificate that includes multiple fully
qualified domain names in the Subject Alternative Name extension.

Copyright © 2009 Starfield Technologies, Inc. All rights reserved.

65

Starfield CP-CPS V2.5